PT-2026-27181 · Unknown · Mailenable

Egidio Romano · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-32852

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.55

Description The software contains a reflected cross-site scripting issue in the webmail interface. Remote attackers can execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

Recommendations Update to version 10.55 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32852

Produtos afetados

Mailenable

Referências · 6

• 🔥 https://karmainsecurity.com/KIS-2026-05 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32852 · Nota de Segurança
• https://mailenable.com/rss/article.asp?Source=RSSADMIN&ID=MAILENABLEVERSION1055 · Correção, Aviso do Fabricante
• https://mailenable.com/Standard-ReleaseNotes.txt · Nota
• https://mailenable.com · Nota
• https://vulncheck.com/advisories/mailenable-reflected-xss-via-freebusy-aspx-startdate-parameter · Nota