PT-2026-27180
CVE-2026-32851
·
Publicado
2026-03-23
·
Atualizado
2026-05-08
Descrição por
CVSS 3.1
6.1
MédiaMétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
MailEnable versions prior to 10.55
Description
The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the
Attendees parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.Recommendations
Update MailEnable to version 10.55 or later.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾