CVE-2022-50908

5.1 mediumEPSS 0.3%

Medium (5.1). EPSS 0.3% chance of exploitation in the next 30 days.

Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can send crafted emails with XSS payloads to execute arbitrary API calls, including message deletion and browser manipulation.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/mailhog/MailHog
https://www.exploit-db.com/exploits/50971
https://www.shodan.io/search?query=mailhog
https://www.vulncheck.com/advisories/mailhog-stored-cross-site-scripting-xss

Check your stack JSON