Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-3929

Stored XSS vulnerability in MDaemon Email Server

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ESET

Description

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MDaemon Email Server

Default version status: unaffected

  • 0 to ≤ 25.0.1affected
  • 25.0.2unaffected

References