The flaw is a reflected XSS in HSC MailInspector's /tap/tap.php endpoint. User input is not neutralized, so a malicious actor can embed arbitrary JavaScript that is reflected in HTTP responses and executed with the victim's browser privileges. This can lead to session cookie theft, credential hijacking, phishing, and further malicious payload execution, representing a client‑side exploitation vector that endangers confidentiality and integrity.

HSC MailInspector version 5.3.3‑7 is affected. The vulnerability resides in the /tap/tap.php endpoint. No other products or versions are listed.

No CVSS or EPSS scores are published and the flaw is not in the CISA KEV catalog. The attack requires only a crafted request and a victim visiting the malicious URL, so the attack vector is simple and the potential impact is high for targeted users. While widespread exploitation is not yet recorded, the vulnerability can still be abused in phishing campaigns without advanced infrastructure.