CVE-2022-39195

Deeper analysis

A cross-site scripting vulnerability tracked as CVE-2022-39195 affects the web interface of LISTSERV 17. The flaw, classified under CWE-79, permits remote attackers to supply arbitrary JavaScript or HTML through the c parameter, producing a CVSS 3.1 score of 6.1 that reflects network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated attacker can craft a malicious link containing the c parameter and deliver it to a victim; when the recipient interacts with the link, the injected code executes in the context of the LISTSERV application, enabling theft of session data or limited interface manipulation.

EPSS probability for the issue rose from a low baseline to a peak of 0.3139 on 2026-02-04 before receding to the current value of 0.0997, indicating a period of increased exploitation interest after public disclosure. Public references include exploit code posted to Packet Storm and discussion threads on the vendor’s LISTSERV mailing list, though no specific patch or mitigation guidance is detailed in the available references.