PatchSiren

GFI Software CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM GFI Software CVE published 2026-07-23

CVE-2026-48535

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration. Authenticated attackers can inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and is executed in the browsers of users who subsequently view the General Settings [truncated]