Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS) | Advisories

Advisories

Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)

severity: medium
date: January 13, 2026
Affecting: Mailhog 1.0.1
CVE: CVE-2022-50908
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-50971
MailHog GitHub Repository
Shodan Search Results for MailHog
Credit: Vulnz
Description: Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can send crafted emails with XSS payloads to execute arbitrary API calls, including message deletion and browser manipulation.