PT-2026-27180 · Mailenable · Mailenable

Egidio Romano · Publicado 2026-03-23 · Atualizado 2026-05-08 · CVE-2026-32851

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.55

Description The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the Attendees parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

Recommendations Update MailEnable to version 10.55 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32851

Produtos afetados

Mailenable

Referências · 8

• 🔥 https://karmainsecurity.com/KIS-2026-05 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32851 · Nota de Segurança
• https://vulncheck.com/advisories/mailenable-reflected-xss-via-freebusy-aspx-startdate-parameter · Nota
• https://t.me/cveNotify/162718 · Publicação no Telegram
• https://mailenable.com/rss/article.asp?Source=RSSADMIN&ID=MAILENABLEVERSION1055 · Correção, Aviso do Fabricante
• https://vulncheck.com/advisories/mailenable-reflected-xss-via-freebusy-aspx-attendees-parameter · Nota
• https://mailenable.com/Standard-ReleaseNotes.txt · Nota
• https://mailenable.com · Nota