CVE-2024-9103

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.

Scoring

Severity

MEDIUM

CVSS base score

6.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS probability

0.22%

CWE

CWE-83

Published

2025-03-24

Last modified

2026-03-13

Affected products

• Forcepoint Email Security

Weakness type

• CWE-83

Related vulnerabilities

• CVE-2026-45118 — MyBB: Contact page reflected XSS
• CVE-2026-45733 — Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
• CVE-2026-15920 — Potential cross-site scripting via URLField values in the admin
• CVE-2026-62324 — Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
• CVE-2026-59727 — Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
• CVE-2026-49276 — Kirby: Self cross-site scripting (self-XSS) in the writer field
• CVE-2026-58263 — Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
• CVE-2026-48591 — Stored XSS via unescaped HTML attribute values in earmark

Markdown version · Browse all CVEs