CVE-2020-27982

IceWarp WebMail version 11.4.5.0 is vulnerable to Cross-Site Scripting (XSS) due to the improper neutralization of input via the language parameter in the /webmail/ endpoint. An attacker can exploit this by providing a malicious payload in a GET request (e.g., `?language=

Icewarp WebMail 11.4.5.0 Cross Site Scripting

Title: IceWarp WebMail Cross-Site Scripting Vulnerability + Date: 2020/10/25 + Author: Harun Karakış + Vendor Homepage: www.icewarp.com + Tested on: Windows 10 + Versions: 11.4.5.0 + Vulnerable Parameter: "language" Get Method + Vulnerable File: /webmail/ + Cve:CVE-2020-27982 PoC: + Go to :...