CVE-2023-27641

Deeper analysis

The vulnerability is a reflected cross-site scripting flaw (CWE-79) in the REPORT parameter of wa.exe within L-Soft LISTSERV versions 16.5 before 17. An attacker can supply a crafted URL that triggers the issue when processed by the application, producing a CVSS 6.1 rating driven by network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated remote attacker can exploit the flaw by delivering a malicious link to a victim; successful execution allows the attacker to run arbitrary script in the context of the victim's browser session, resulting in limited impacts to confidentiality and integrity.

The provided references consist of a public proof-of-concept exploit rather than vendor advisories or patch details. The EPSS score rose sharply from a low baseline to a peak of 0.5430 on 2026-03-06 before receding to the current value of 0.0472, indicating that exploitation interest increased after disclosure.