← Vulnerability feed

Vulnerability record · CVE-2021-31739 · published 18 November 2022

CVE-2021-31739: Seppmail cross-site scripting vulnerability

Seppmail · Seppmail

The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address.

6.1 CVSS 3.1 Medium EPSS 0.44% · top 63.9% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-seppmail/ ExploitThird Party Advisory
https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-seppmail/ ExploitThird Party Advisory

Track CVE-2021-31739 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-2743Seppmail path traversal vulnerabilityArbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transf…EPSS 0.99%9.5CVE-2026-27441Seppmail os command injection vulnerabilitySEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.EPSS 0.55%9.3CVE-2026-27442Seppmail path traversal vulnerabilityThe GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, …EPSS 0.46%8.8CVE-2022-41871Seppmail os command injection vulnerabilitySEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute arbitrary code in the context…EPSS 1.1%8.2CVE-2026-27443Seppmail improper input validation vulnerabilitySEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker …EPSS 0.37%7.8CVE-2026-2748Seppmail improper certificate validation vulnerabilitySEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allow…EPSS 0.19%7.8CVE-2026-27444Seppmail interpretation conflict vulnerabilitySEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict w…EPSS 0.37%6.9CVE-2026-2747Seppmail information exposure vulnerabilitySEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowin…EPSS 0.42%

Source: NIST National Vulnerability Database (record CVE-2021-31739), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.