Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
430 results · page 2 of 9
May 25, 2026Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash esCVE-2026-48842 · Email & office · reported by MITREHigh 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extCVE-2026-8851 · Other software · Alinto · reported by VulnCheckHigh 8.6
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
- Product
- SOGo Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.CVE-2026-35391 · Other software · bulwarkmail · reported by GitHubHigh 8.7
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.
- Product
- webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.CVE-2026-35390 · Other software · bulwarkmail · reported by GitHubMedium 5.3
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-site scripting (XSS) attacks were logged but not blocked. Any user who could inject script content (e.g., via crafted email HTML) could execute arbitrary JavaScript in the context of the application, potentially stealing session tokens or performing actions on behalf of the user. This vulnerability is fixed in 1.4.11.
- Product
- webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.CVE-2026-35389 · Other software · bulwarkmail · reported by GitHubHigh 8.7
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed in 1.4.11.
- Product
- webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15.CVE-2026-35545 · Email & office · reported by MITREMedium 5.3
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35544 · Email & office · reported by MITREMedium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35543 · Email & office · reported by MITREMedium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35542 · Email & office · reported by MITREMedium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35541 · Email & office · reported by MITREMedium 4.2
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14.CVE-2026-35540 · Email & office · reported by MITREMedium 5.4
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35539 · Email & office · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35538 · Email & office · reported by MITRELow 3.1
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35537 · Email & office · reported by MITRELow 3.7
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.CVE-2026-34834 · Other software · bulwarkmail · reported by GitHubHigh 8.7
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.
- Product
- webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.CVE-2026-34833 · Other software · bulwarkmail · reported by GitHubHigh 8.7
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.
- Product
- webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitCVE-2026-32852 · Other software · MailEnable · reported by VulnCheckMedium 5.1
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
- Product
- MailEnable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.commailenable.com
Mar 23, 2026MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitCVE-2026-32851 · Other software · MailEnable · reported by VulnCheckMedium 5.1
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
- Product
- MailEnable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.commailenable.com
Mar 23, 2026MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitCVE-2026-32850 · Other software · MailEnable · reported by VulnCheckMedium 5.1
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the SelectedIndex parameter in the ManageShares.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
- Product
- MailEnable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.commailenable.com
Mar 20, 2026Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest).CVE-2026-33368 · Email & office · Synacor · reported by MITREMedium 6.1
Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a victim user accesses the link, the injected script executes in the context of the Zimbra webmail application, which could allow the attacker to perform actions on behalf of the victim.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Feb 11, 2026Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.CVE-2026-26079 · Email & office · reported by MITREMedium 4.7
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.CVE-2026-25916 · Email & office · reported by MITREMedium 4.3
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnews.ycombinator.com
Dec 18, 2025RoundCube Webmail Cross-site Scripting VulnerabilityCVE-2025-68461 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.2
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
- Product
- Webmail
- On CISA’s list since
- Feb 20, 2026 (federal fix deadline Mar 13, 2026)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comroundcube.net
Dec 18, 2025Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.CVE-2025-68460 · Email & office · reported by MITREHigh 7.2
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Oct 31, 2025An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below.CVE-2025-12460 · Other software · Afterlogic · reported by security@eset.comMedium 5.3
An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
- Product
- Aurora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordauroramail.wordpress.com
Aug 4, 2025An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of oCVE-2025-50340 · Other software · reported by MITREMedium 4.3
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. The server fails to verify whether the authenticated user is authorized to use the specified sender identity, resulting in unauthorized message delivery as another user. This can lead to impersonation, phishing, or unauthorized communication within the system. NOTE: this is disputed by the Supplier because the only effective way to prevent this sender spoofing is on the SMTP server, not within a client such as SOGo.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Jun 2, 2025RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVE-2025-49113 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.9
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
- Product
- Webmail
- On CISA’s list since
- Feb 20, 2026 (federal fix deadline Mar 13, 2026)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfearsoff.orggithub.com
Mar 31, 2025A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4CVE-2023-33302 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.7
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
- Product
- FortiNDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Feb 3, 2025Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leadingCVE-2024-57004 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.CVE-2024-54663 · Email & office · Synacor · reported by MITREHigh 7.5
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Nov 21, 2024In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads.CVE-2024-45194 · Email & office · Synacor · reported by MITREMedium 4.8
In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This injected code is stored on the server and executed in the context of the victim's browser when interacting with specific elements in the web interface. (The vulnerability can be mitigated by properly sanitizing input parameters to prevent the injection of malicious code.)
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Nov 21, 2024An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1.CVE-2024-45512 · Email & office · Synacor · reported by MITREMedium 5.4
An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a victim. When the victim interacts with the folder share notification, the malicious script executes in their browser. This stored Cross-Site Scripting (XSS) vulnerability can lead to unauthorized actions within the victim's session.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Nov 7, 2024A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoCVE-2024-50599 · Email & office · Synacor · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the HTML response.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Aug 5, 2024RoundCube Webmail Cross-Site Scripting VulnerabilityCVE-2024-42009 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.3
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- Product
- Webmail
- On CISA’s list since
- Jun 9, 2025 (federal fix deadline Jun 30, 2025)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Aug 5, 2024A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and sCVE-2024-42008 · Websites & servers · Roundcube · reported by MITRECritical 9.3
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server.CVE-2024-34539 · Other software · terra-master · reported by MITRECritical 9.4
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.
- Product
- tos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshinnai.altervista.orgshinnai.altervista.org
Jun 7, 2024Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path.CVE-2024-37385 · Websites & servers · roundcube · reported by MITRECritical 9.8
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
- Product
- roundcube_webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2024Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.CVE-2024-37384 · Websites & servers · roundcube · reported by MITREMedium 6.1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
- Product
- roundcube_webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2024RoundCube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2024-37383 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
- Product
- Webmail
- On CISA’s list since
- Oct 24, 2024 (federal fix deadline Nov 14, 2024)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 1, 2024WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.CVE-2024-25080 · Other software · reported by MITREMedium 4.7
WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewingCVE-2023-49101 · Other software · Axigen · reported by MITREMedium 6.1
WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates.
- Product
- Axigen Mobile Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_iCVE-2023-48974 · Other software · Axigen · reported by MITRECritical 9.6
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.
- Product
- Axigen Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.CVE-2024-24131 · Other software · Superwebmailer · reported by MITREMedium 6.1
SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attCVE-2023-40355 · Other software · Axigen · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.
- Product
- Axigen Mobile Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and bCVE-2023-45582 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.6
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts.
- Product
- FortiMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Nov 14, 2023An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and CVE-2023-36633 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.4
An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.
- Product
- FortiMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Nov 5, 2023Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).CVE-2023-47272 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38194 · Other software · Superwebmailer · reported by MITREMedium 6.1
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38193 · Other software · Superwebmailer · reported by MITREHigh 8.8
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38192 · Other software · Superwebmailer · reported by MITREMedium 6.1
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.