{"id":"CVE-2003-0038","aliases":["GHSA-82rm-28q9-435p","PYSEC-2026-657"],"title":"Mailman Cross-site scripting (XSS) vulnerability ","summary":"Mailman Cross-site scripting (XSS) vulnerability ","severity":"medium","vendor":"mailman","product":"mailman","ecosystem":"pip","affected":["mailman < 2.1.1"],"patched":["mailman 2.1.1"],"published":"2022-04-29","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-82rm-28q9-435p","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0038"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11152"},{"url":"http://marc.info/?l=bugtraq&m=104342745916111"},{"url":"http://telia.dl.sourceforge.net/sourceforge/mailman/xss-2.1.0-patch.txt"},{"url":"http://www.debian.org/security/2004/dsa-436"},{"url":"http://www.osvdb.org/9205"},{"url":"http://www.securityfocus.com/bid/6677"},{"url":"http://www.securitytracker.com/id?1005987"}],"tags":["osv","pip","exploit-available"],"epss":0.0476,"epssPercentile":0.91503,"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:47.272Z","exploits":{"exploitdb":true,"checkedAt":"2026-09-21T15:24:34.726Z"},"slug":"CVE-2003-0038","body":"## Overview\n\nCross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.\n\n## Affected packages\n\n- `mailman < 2.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mailman 2.1.1`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":27.5,"likelihood":1,"exploitation":12,"ransomware":0},"changes":[]}