The vulnerability resides in the /police/WarningUrlPage.php endpoint of HSC MailInspector 5.3.3–7, allowing an attacker to inject arbitrary JavaScript because the application fails to neutralize user‑supplied input that contains alternate or obfuscated script syntax. This flaw permits the execution of malicious code in the victim’s browser, potentially leading to session hijacking, defacement, or redirection to phishing sites. The impact encompasses confidentiality, integrity, and availability of the affected web interface.

HSC MailInspector versions 5.3.3 through 5.3.7 are impacted. The issue is confined to the WarningUrlPage.php script accessed via the /police/ sub‑directory. No other vendors or products are listed in the CVE record.

The CVSS score is 6.1, EPSS is not available, and the vulnerability is not listed in KEV. The description does not specify any authentication requirement; based on the description, it is inferred that the endpoint can be accessed without authentication, allowing an attacker to supply malicious input by simply visiting the URL. This suggests a high likelihood of successful exploitation in environments where the endpoint is exposed to the public or to untrusted users. Because the flaw results in JavaScript execution in the context of any user who visits the warning page, the risk to the organization is significant.