CVE-2026-48530
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
50/100
Published: 2026-07-23
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
None
VC:
None
VI:
None
VA:
None
Description
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.