CVE-2015-9276: SmarterTools SmarterMail

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.

Affected products

• SmarterTools SmarterMail: before 13.3.5535 (fixed in 13.3.5535)

Published 2019-01-16. Last modified 2026-06-17.