CVE-2017-11737: Rspamd Project Rspamd

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page.

Affected products

• Rspamd Project Rspamd: up to and including 1.6.2

Published 2017-07-29. Last modified 2026-06-17.