CVE-2012-2586

CVE-2012-2586 describes multiple persistent Cross-Site Scripting (XSS) vulnerabilities in Mailtraq version 2.17.3.3150. These flaws allow remote attackers to inject arbitrary web script or HTML through various email message components, including the subject, body, and Date header, utilizing methods like JavaScript functions, SCRIPT elements, crafted IFRAME SRC attributes, data: URLs in META refresh tags, and CSS expressions. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and a potential impact of partial information disclosure. No authentication is required for exploitation. While there is no evidence of active exploitation in the wild (KEV list), public exploit code is available via ExploitDB (EDB-20353). Despite this, the CVE has received minimal community discussion and media coverage.