CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer

published December 23, 2016

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02345 · 83.4th percentile
Published
2016-12-23T22:00Z
EPSS history
Timeline
  • 23 DEC 22:00Z
    Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer
    cvelistv5