CVE-2023-39223

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
A.K.I Softwarepmc.exe2.5.1.720 and earlier
A.K.I Softwarepmam.exe2.5.1.1411 and earlier
A.K.I Softwarepmum.exe (Standard edition)2.5.1.25451 and earlier
A.K.I Softwarepmum.exe (Pro edition)2.5.1.25452 and earlier
A.K.I Softwarepmum.exe (Standard + IMAP4 edition)2.5.1.25453 and earlier
A.K.I Softwarepmum.exe (Pro + IMAP4 edition / Enterprise edition)2.5.1.25454 and earlier

References

Timeline

Published
Mar 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-392248.0Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated atCVE-2023-392269.8In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary cCVE-2023-392277.5​Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate uCVE-2023-392287.5Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via networkCVE-2023-392307.8Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user CVE-2023-392316.5PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existCVE-2023-392336.5The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive informatCVE-2023-392347.8Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crCVE-2023-392357.8Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crCVE-2023-392368.8ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user priCVE-2023-392378.8ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular userCVE-2023-392387.2It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value