Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50908Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)
High 7.2
In plain English
A high-severity cross-site scripting in Mailhog from Mailhog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.3%top 77.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can send crafted emails with XSS payloads to execute arbitrary API calls, including message deletion and browser manipulation.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
References
- ExploitDB-50971 exploit
- MailHog GitHub Repository product
- Shodan Search Results for MailHog product
- VulnCheck Advisory: Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS) third-party-advisory