A stored cross-site scripting vulnerability exists in GFI Archiver before 15.14 in the MailInsights scheduled report configuration. Authenticated attackers can inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored without output encoding and executed in the browser of the user who created the scheduled report when they view the Mai [truncated]
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration. Authenticated attackers can inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and is executed in the browsers of users who subsequently view the General Settings [truncated]
A stored cross-site scripting vulnerability exists in GFI Archiver before version 15.14. The issue is located in the Classification Rules configuration, specifically in the rule name and email criteria parameters of the /Archiver/CategorizationPolicyWizard.aspx page. Authenticated attackers can inject arbitrary web script or HTML, which is then stored without output encoding. When users view the Classific [truncated]
