CVE-2025-2150: HGiga C&Cm@il - Stored Cross-Site Scripting

Published Mar 10, 2025

Updated

The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.

Affected Software

2 affected components

Hgiga C&Cm@il

Hgiga C\&cm\@il

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mailk-mail to a version that resolves this vulnerability.
Fixed in 1.0-238

Event History

Mar 10, 2025

CVE Published

via MITRE·07:12 AM

Data Sourced

via MITRE·07:12 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-2150?

CVE-2025-2150 is considered a medium severity vulnerability due to the potential for exploitation through stored cross-site scripting.

How do I fix CVE-2025-2150?

To fix CVE-2025-2150, ensure that your version of HGiga C&Cm@il is updated to the latest patch provided by the vendor.

What type of vulnerability is CVE-2025-2150?

CVE-2025-2150 is a Stored Cross-Site Scripting (XSS) vulnerability that affects emails sent through the HGiga C&Cm@il application.

Who is affected by CVE-2025-2150?

Any user of HGiga C&Cm@il who receives emails with embedded malicious JavaScript is affected by CVE-2025-2150.

What can attackers do with CVE-2025-2150?

Attackers can exploit CVE-2025-2150 by sending emails that execute malicious JavaScript code in the recipient's browser, potentially leading to data theft or session hijacking.