5.3Medium
CVE-2025-3929Stored XSS vulnerability in MDaemon Email Server
Description
An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| MDaemon | Email Server | ≤ 25.0.1, fixed 25.0.2 |
References and patches
- https://mdaemon.com/pages/downloads-critical-updates Release Notes
CPE matches (NVD) (9)
cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 20.0.0 < 20.0.9cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 21.0.0 < 21.0.8cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 21.5.0 < 21.5.6cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 22.0.0 < 22.0.7cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 23.0.0 < 23.0.4cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 23.5.0 < 23.5.5cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 24.0.0 < 24.0.4cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 24.5.0 < 24.5.3cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*≥ 25.0.0 < 25.0.2