415 matches found
CVE-2023-48104
CVE-2023-48104 HTML-Injection im Alinto/SOGo Web Client Anbieter des Produkts Alinto Schwachstellentyp HTML-Injection Betroffene Versionen SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Entdecker Spiridonov Ivan/E1tex PoC Nur zu Demonstrationszwecken...
CVE-2025-63498
Stored XSS im Cookie von Alinto/SOGo Forscher: Daniil Khomichenok, Alexander Klimenko Betroffene Versionen var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Code des Set-Cookie für „Benutzernamen merken“, der XSS-Injektionen als Parameterwert...
CVE-2022-4556
CVE-2022-4556 - SOGo Webmail में Stored XSS v5.7.1 🧠 सारांश एक Stored Cross-Site Scripting XSS भेद्यता SOGo वेब इंटरफ़ेस के पहचान प्राथमिकताएँ अनुभाग के fullName फ़ील्ड में पाई गई, जो संस्करण 5.7.1 को प्रभावित करती है। एक प्रमाणित हमलावर एक दुर्भावनापूर्ण स्क्रिप्ट इंजेक्ट कर सकता है जो किसी भी...
CVE-2025-63499
XSS Refletido Direcionado no parâmetro theme Pesquisadores: Arseniy Poblaguev, Daniil Khomichenok Versões Afetadas = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Data: 02.12.2025 No parâmetro theme existe uma vulnerabilidade de XSS Refletido:...
SOGo_web_mail-vulnerability-CVE-2025-50340
CVE-2025-50340: Unsichere direkte Objektreferenz IDOR-Schwachstelle in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Produkt: SOGo Betroffene Versionen: v5.6.0 Auswirkung: Unsichere direkte Objektreferenz IDOR-Schwachstelle → Ermöglicht dem Benutzer, E-Mails im Namen eines anderen...
VulnCheck KEV: CVE-2026-8496
A cross-site scripting XSS vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS...
Linux Distros Unpatched Vulnerability : CVE-2026-39179
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password...
Linux Distros Unpatched Vulnerability : CVE-2026-39178
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the...
EUVD-2026-42500
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
EUVD-2026-42499
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
DEBIAN-CVE-2026-39179
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
DEBIAN-CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
CVE-2026-39179
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
CVE-2026-39179
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
UBUNTU-CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
UBUNTU-CVE-2026-39179
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
