PT-2026-27181

CVE-2026-32852

Published

2026-03-23

Updated

2026-03-23

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.55

Description The software contains a reflected cross-site scripting issue in the webmail interface. Remote attackers can execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

Recommendations Update to version 10.55 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Egidio Romano

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers