CVE-2026-102372

MediumCVSS 6.1/10Last modified Sep 30, 2026

Description

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1023736.5GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authentic CVE-2026-1023746.1GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-enco CVE-2026-1023756.5Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2026-1023767.1Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-1023778.8Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.CVE-2026-1023787.1Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.CVE-2026-1023798.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder CVE-2026-1023815.3Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Secur CVE-2026-1023824.3Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Conf CVE-2026-1023836.5Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Level CVE-2026-1023845.9Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.CVE-2026-1023857.1Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.