PT-2026-27179 · Unknown · Mailenable

Egidio Romano · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-32850

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.55

Description The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the SelectedIndex parameter in the ManageShares.aspx form, which is not properly sanitized before being included in dynamically generated JavaScript.

Recommendations Update MailEnable to version 10.55 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32850

Produtos afetados

Mailenable

Referências · 6

• 🔥 https://karmainsecurity.com/KIS-2026-05 · Exploit
• https://vulncheck.com/advisories/mailenable-reflected-xss-via-manageshares-aspx-selectedindex-parameter · Nota
• https://mailenable.com/rss/article.asp?Source=RSSADMIN&ID=MAILENABLEVERSION1055 · Correção, Aviso do Fabricante
• https://mailenable.com/Standard-ReleaseNotes.txt · Nota
• https://mailenable.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32850 · Nota de Segurança