CVE-2026-32850 MailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the SelectedIndex paramete...

CVE-2026-32850

MailEnable before 10.55 exposes a reflected XSS in the webmail ManageShares.aspx?SelectedIndex parameter. The input is embedded into dynamically generated JavaScript without proper sanitization, allowing remote attackers to execute arbitrary JavaScript in a victim’s browser via a crafted URL. CVS...

MailEnable cross-site scripting vulnerability

MailEnable is a Windows-based business email server. A cross-site scripting vulnerability exists in the MailEnable SelectedIndex parameter. The vulnerability stems from improper cleanup of the SelectedIndex parameter of the ManageShares.aspx form in the Webmail interface, which can be exploited b...