CVE-2025-34425: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the WindowContext parameter of /Mondo/lang/sys/Forms/MAI/compose.aspx. The WindowContext value is not properly sanitized when processed via a GET request and is reflected within a...

CVE-2025-34408: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Added parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Added value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an...

CVE-2025-34399: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesCc value is not properly sanitized when processed via a GET request and is reflected within a...

CVE-2025-34398: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the AddressesBcc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesBcc value is not properly sanitized when processed via a GET request and is reflected within a...

CVE-2025-34400: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the AddressesTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesTo value is not properly sanitized when processed via a GET request and is reflected within a...

CVE-2025-34409: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Failed parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Failed value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an...

CVE-2025-34402: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldCc value is not properly sanitized when processed via a GET request and is reflected inside a...

CVE-2025-34401: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldBcc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldBcc value is not properly sanitized when processed via a GET request and is reflected inside a...

CVE-2025-34403: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldTo value is not properly sanitized when processed via a GET request and is reflected inside a...

CVE-2025-34406: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a...

CVE-2025-34404: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the InstanceScope parameter of /Mondo/lang/sys/Forms/CAL/compose.aspx. The InstanceScope value is not properly sanitized when processed via a GET request and is reflected inside a...

CVE-2025-34407: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...

PT-2025-50143

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description The software contains a reflected cross-site scripting XSS issue in the InstanceScope parameter of the ''/Mondo/lang/sys/Forms/CAL/compose.aspx'' endpoint. The InstanceScope value is not properly...

PT-2025-50136

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Message parameter of the ''/Mobile/Compose.aspx'' API endpoint. The Message value is not proper...

PT-2025-50147

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description The software contains a reflected cross-site scripting XSS issue in the Failed parameter of the ''/Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx'' endpoint. The Failed value is not properly...

PT-2025-50234

Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4 Description OpenBMCS version 2.4 contains a flaw that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requests to the /debug/obix test.php endpoint with...

PT-2025-50272

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the WindowContext parameter of the ''/Mondo/lang/sys/Forms/MAI/compose.aspx'' endpoint. The...

PT-2025-50137

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS issue in the AddressesBcc parameter of the ''/Mondo/lang/sys/Forms/AddressBook.aspx'' endpoint. The AddressesBcc val...

CVE-2025-60912

phpIPAM v1.7.3 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within its database export functionality. The generate-mysql.php function, located at the /app/admin/import-export/ endpoint, lacks sufficient CSRF protection. This allows a remote attacker to trigger large database...

The vulnerability of the Mattermost instant messaging application, related to insufficient protection of operational data, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Mattermost instant messaging application is related to insufficient protection of sensitive data during the processing of the /api/v4/channels/channelid/commonteams endpoint. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...