PT-2026-6593 · Axigen · Axigen Mail Server

Publicado 2026-02-05 · Atualizado 2026-02-05 · CVE-2025-68723

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axigen Mail Server versions prior to 10.5.57

Description Axigen Mail Server contains multiple stored Cross-Site Scripting (XSS) issues within the WebAdmin interface. These issues exist in three areas: the log file name parameter on the Local Services Log page, certificate file content in the SSL Certificates View Usage feature, and the Certificate File name parameter in the WebMail Listeners SSL settings. Successful exploitation allows attackers to inject malicious JavaScript payloads that execute in administrators' browsers when accessing affected pages or features. This can lead to privilege escalation, enabling low-privileged administrators to force high-privileged administrators to perform unauthorized actions. The vulnerable parameters include the log file name, certificate file content, and Certificate File name.

Recommendations Update Axigen Mail Server to version 10.5.57 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-68723

Produtos afetados

Axigen Mail Server

Referências · 6

• 🔥 https://github.com/osmancanvural/CVE-2025-68723 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68723 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-68723 · Aviso do Fabricante
• https://axigen.com/knowledgebase/Axigen-WebAdmin-Stored-XSS-Vulnerabilities-CVE-2025-68723-_408.html · Aviso do Fabricante
• https://axigen.com/mail-server/download · Nota
• https://twitter.com/CVEnew/status/2019472438623424735 · Publicação no Twitter