PT-2025-50145 · Unknown · Mailenable

Mushroomsecteam · Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-34407

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54

Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) issue in the theme parameter of the ''/Mondo/lang/sys/Forms/Statistics.aspx'' endpoint. The theme value is not adequately sanitized when handled through a GET request and is echoed in the response. This allows an attacker to inject arbitrary script, potentially breaking out of an iframe context. Successful exploitation could redirect victims to malicious sites, steal cookies, or inject HTML/CSS, and perform actions as an authenticated user.

Recommendations Update MailEnable to version 10.54 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34407

Affected Products

Mailenable

References · 6

• https://osv.dev/vulnerability/CVE-2025-34407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34407 · Security Note
• https://mailenable.com/Standard-ReleaseNotes.txt · Patch
• https://twitter.com/CVEnew/status/1998781324698493260 · Twitter Post
• https://vulncheck.com/advisories/mailenable-reflected-xss-in-theme-parameter-of-statistics-aspx · Note
• https://mailenable.com · Note