A remote cross‑site scripting vulnerability exists in the URL Handler component of HSC Cybersecurity Mailinspector, specifically in the /mailinspector/mliUserValidation.php file. The flaw is triggered by manipulating the error_description argument, causing the application to render untrusted data as script. This weakness corresponds to CWE‑79 and CWE‑94. An attacker who supplies a crafted error_description value can inject arbitrary JavaScript that will execute in the context of any authenticated user who views the page, enabling theft of session cookies, defacement, or unauthorized actions.

HSC Cybersecurity Mailinspector versions up to and including 5.3.2-3 are affected. The vulnerability is present in the component that handles URLs through mliUserValidation.php and does not appear in newer releases beginning with 5.4.0.

The CVSS score for this issue is 5.3, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation at present, and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious error_description value, typically via a crafted URL or form submission that can be delivered to a susceptible user. Since the attack can be performed from remote and the exploit code has been made public, defenders should treat this as a potential risk for targeted phishing or compromised email content. The lack of an authentication requirement means that only the user interacting with the payload needs to be routed through the vulnerable component for the script to execute.