DescriptionSmarterMail builds prior to 9526 contain a reflected cross-site scripting (XSS) vulnerability in the MailboxId GET parameter of the MAPI endpoints. User-supplied input is not properly sanitized before being included in generated HTML responses, allowing an attacker to inject malicious scripts that execute in a victim's browser. Successful exploitation may enable session hijacking, credential theft, and in certain deployment scenarios could facilitate one-click remote command execution (RCE) through administrative interface abuse.