CVE-2020-25925

Name of the Vulnerable Software and Affected Versions: IceWarp WebClient version 10.3.5

Description: The issue allows remote attackers to inject arbitrary web script or HTML via the p4 field in the Webmail Calendar, potentially leading to Cross Site Scripting (XSS) attacks.

Recommendations: For IceWarp WebClient version 10.3.5, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Webmail Calendar to minimize the risk of exploitation. Avoid using the p4 field in the affected Webmail Calendar until the issue is resolved.