CVE-2024-34697

CVE-2024-34697 is a stored HTML injection vulnerability in the Email Receival Module of FreeScout, a self-hosted help desk and shared mailbox application. Unauthenticated attackers can inject malicious HTML content into emails sent to the application, leading to potential form hijacking, application defacement, or data exfiltration via CSS injection. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity requiring user interaction, resulting in low confidentiality and integrity impact. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog. Version 1.8.139 addresses this by implementing strict input validation and sanitization.