The vulnerability is a stored cross-site scripting flaw in GFI Archiver's MailInsights module. An authenticated attacker who can create or edit scheduled reports can include malicious script or HTML in the report name, which is saved without proper output encoding. When the report owner later views the MailInsights page, the injected payload is served in the browser, allowing the attacker to execute code in the context of that user, potentially impacting session integrity, confidentiality, or integrity of data visible to that user.

Affected systems are installations of GFI Archiver released before version 15.14. The flaw resides in the ReportScheduling.btnSaveReport_Click() handler that processes the report name field. All users who can configure scheduled reports on those versions are at risk. The CVE details do not mention specific OS or hardware platforms, only the application version.

The CVSS score of 5.1 indicates a moderate severity, and the lack of an EPSS value means the exploit probability is undetermined. The vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation at the time of the advisory. Attackers require authenticated access with report‑creation privileges; typical exploitation would involve an attacker compromising a user account or prompting a privileged user to enable a malicious report. Because the code runs in the user's browser, risk is confined to the victim's session unless cross‑domain storage or other privileges are abused.