The vulnerability resides in the /police/WarningUrlPage.php endpoint of HSC MailInspector 5.3.3–7, allowing an attacker to inject arbitrary JavaScript because the application fails to neutralize user‑supplied input that contains alternate or obfuscated script syntax. This flaw permits the execution of malicious code in the victim’s browser, potentially leading to session hijacking, defacement, or redirection to phishing sites. The impact encompasses confidentiality, integrity, and availability of the affected web interface.

HSC MailInspector versions 5.3.3 through 5.3.7 are impacted. The issue is confined to the WarningUrlPage.php script accessed via the /police/ sub‑directory. No other vendors or products are listed in the CVE record.

The CVSS score is not provided, and the EPSS rating is unavailable; the vulnerability is not yet listed in CISA’s KEV catalog. The CVE description does not specify any authentication requirement; based on the description, it is inferred that the endpoint can be accessed without authentication, allowing an attacker to supply the malicious input by simply visiting the URL. This suggests a high likelihood of successful exploitation in environments where the endpoint is exposed to the public or to untrusted users. Because the flaw results in code execution in the context of any user who visits the warning page, the risk to the organization is significant.