CVE-2025-3875

CVE-2025-3875 affects Thunderbird. The issue arises from how Thunderbird parses addresses, allowing sender spoofing if the server permits an invalid From address; e.g., a From header value like "Spoofed Name" can cause the address to appear as [email protected]. Impact is spoofing of From: head...

CVE-2025-47280 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workfl...

PT-2025-21188

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.10.1 Thunderbird versions prior to 138.0.1 Description: The issue allowed an attacker to craft an email that showed a tracking link as an attachment. When the user attempted to open the attachment, Thunderbir...

CVE-2025-2545

Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES 3DES cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could...

Microsoft Windows - XRM-MS File NTLM Information Disclosure Spoofing

Exploit Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Source: https://hyp3rlinx.altervista.org/advisories/MicrosoftWindowsxrm-msFileNTLM-HashDisclosure.txt x.com/hyp3rlinx ISR: ApparitionSec Vendor www.microsoft.com Product .xrm-ms File Type Vulnerability Type NTLM Hash...

PT-2025-18143

Name of the Vulnerable Software and Affected Versions MDaemon Email Server versions 25.0.1 and below Description A Stored Cross-Site Scripting XSS issue was discovered, allowing a remote attacker to send a specially crafted HTML e-mail message with JavaScript in an img tag. This could enable the...

CVE-2024-11922 Input Validation vulnerability in Web Client emails that do not go through Secure Mail

Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email...

CVE-2025-43920

GNU Mailman 2.1.39 (bundled with cPanel/WHM) has a command-injection risk when an external archiver is configured and the email subject line contains shell metacharacters. The root cause is unsanitized subject handling in the archiver/subject processing path, enabling unauthenticated execution of...

CVE-2025-43920

GNU Mailman 2.1.39, as bundled in cPanel and WHM, in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardles...

Mozilla Thunderbird < 128.9.2

The version of Thunderbird installed on the remote Windows host is prior to 128.9.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-27 advisory. - When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header...

Don’t use corporate email for your personal life

TL;DR People use whatever is convenient. Segregation of work and personal matters is a key part of security. Using corporate addresses tramples on this separation. Corporate email addresses should be treated with the same care as sensitive corporate information. Create an Acceptable Use Policy th...

Enterprise Gmail Users Can Now Send End-to-End Encrypted Emails to Any Platform

On the 21st birthday of Gmail, Google has announced a major update that allows enterprise users to send end-to-end encrypted E2EE to any user in any email inbox in a few clicks. The feature is rolling out starting today in beta, allowing users to send E2EE emails to Gmail users within an...

CVE-2024-9103

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security Blocked Messages module allows Stored XSS. This issue affects Email Security through 8.5.5...

CVE-2024-9103

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security Blocked Messages module allows Stored XSS. This issue affects Email Security through 8.5.5...

CVE-2024-9103 Persistent XSS in blocked messages

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security Blocked Messages module allows Stored XSS. This issue affects Email Security through 8.5.5...

CVE-2024-9103

CVE-2024-9103 affects Forcepoint Email Security (Blocked Messages module) with improper neutralization of script in web page attributes, enabling Stored XSS and impacting Email Security up to version 8.5.5. The vulnerability is documented across multiple feeds (NVD, Red Hat, CVE List, VulnEnrichm...

CVE-2024-9103 Persistent XSS in blocked messages

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security Blocked Messages module allows Stored XSS. This issue affects Email Security through 8.5.5...

Forcepoint Email Security 安全漏洞

Forcepoint Email Security is a suite of email protection solutions from US-based Forcepoint. The product includes features such as spam filtering, malware detection, phishing protection, and protection against intrusion BEC attacks. A security vulnerability exists in Forcepoint Email Security 8.5...

CVE-2025-30349

Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute that may use base64-encoded JavaScript code, as exploited in the wild in March 2025...

DOGE to Fired CISA Staff: Email Us Your Personal Data

A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency CISA is the latest exhibit in the Trump administration's continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can ...