PT-2025-54297
CVE-2025-49028
·
Published
2025-12-31
·
Updated
2026-01-05
Description by
CVSS 3.1
7.1
HighMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
Zoho ZeptoMail versions n/a through 3.3.1
Description
A Cross-Site Request Forgery (CSRF) issue exists in Zoho ZeptoMail, also allowing for Stored Cross-Site Scripting (XSS). The issue impacts the way requests are handled, potentially allowing an attacker to perform actions on behalf of an authenticated user without their knowledge.
Recommendations
Versions prior to 3.3.1 should be updated.
Found an issue in the description? Have something to add? Feel free to write us 👾