Description
A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- MindPalette NateMail 3.0.15 - Cross-Site Scripting http/cves/2019/CVE-2019-13392.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.