Description
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator-s browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator-s privileges.
CVSS 6.1EPSS 0.308%Risk 0.63
View source- Published
- 2026-07-13 18:16:30
- Affected versions
- <3.2.0
- Type
- Critical software
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N