A cross‑site scripting flaw in the Extra Innovation acmailer CGI component allows an attacker to inject and execute arbitrary JavaScript in the context of a victim’s browser. The flaw is a classic reflected or stored XSS that can lead to session hijacking, credential theft, defacement or other client‑side attacks. The weakness is identified as CWE-79, a common input validation defect.

Extra Innovation Inc. offers the acmailer CGI module and the acmailer DB component, both of which are affected. Specific version information is not disclosed, so all installed instances of these products should be considered potentially vulnerable until a patch is applied.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits yet. Based on the description, the likely attack vector involves supplying malicious input through the web interface or configuration of acmailer, which is then reflected or stored and executed in users’ browsers. The vulnerability is exploitable by any user who can interact with the affected CGI endpoint and whose browser processes the injected script.