512 matches found
CVE-2025-63498
Stored XSS dans le cookie Alinto/SOGo Chercheurs : Daniil Khomichenok, Alexander Klimenko Versions concernées var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Code du cookie de connexion mémorisé qui accepte les injections XSS comme valeur de...
SOGo_web_mail-vulnerability-CVE-2025-50340
CVE-2025-50340: Insecure Direct Object Reference IDOR vulnerability in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Product: SOGo Affected Versions: v5.6.0 Impact: Insecure Direct Object Reference IDOR vulnerability → Allows the user to send emails on behalf of another user. Summar...
CVE-2022-4556
CVE-2022-4556 - Stored XSS in SOGo Webmail v5.7.1 🧠 Summary A Stored Cross-Site Scripting XSS vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface , affecting version 5.7.1. An authenticated attacker could inject a malicious script that...
CVE-2025-63499
Targeted Reflected XSS in theme parameter Researchers: Arseniy Poblaguev, Daniil Khomichenok Affected Versions = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Date: 02.12.2025 In the theme parameter there are Reflected XSS Vulnerability:...
ROS-20261002-73-0148
The vulnerability of the contact search component in the SOGo collaborative work software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain unauthorized access to protected information...
ROS-20261002-73-0147
The vulnerability of the contact search component in the SOGo collaborative work software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain unauthorized access to protected information...
ROS-20261002-73-0145
The vulnerability in Sogo is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20261002-73-0146
The vulnerability in Sogo is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20261002-73-0143
The vulnerability in Sogo is related to the lack of authentication for the critical function. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
ROS-20261002-73-0144
The vulnerability of the SOGo collaborative software server relates to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...
CVE-2026-93453
CVE-2026-93453 — Отравление ссылки сброса пароля SOGo через заголовок Origin Эксплойт для уязвимости, при которой SOGo формирует ссылку сброса пароля, отправляемую пользователям по электронной почте, напрямую из заголовка Origin, предоставленного клиентом. Анонимный злоумышленник, знающий логин...
CVE-2023-48104
CVE-2023-48104 HTML Injection in Alinto/SOGo Web Client Vendor of Product Alinto Vulnerability Type HTML Injection Affected Versions SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Discoverer Spiridonov Ivan/E1tex PoC For demonstration purposes only. P...
ROS-20261001-73-0055
The vulnerability of the management server’s software for collaborative work, SOGo, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...
ROS-20261001-73-0056
The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...
ROS-20261001-73-0057
The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...
CVE-2026-74864
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
PT-2026-103127
sogo yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
PT-2026-103128
sogo yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's...
The vulnerability of the contact search component of the SOGo software for collaborative work lies in the lack of a password recovery mechanism, allowing attackers to gain unauthorized access to users’ accounts.
The vulnerability of the contact search component in the SOGo software for collaborative work is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to a user’s account through specially craft...
