CVE-2025-60447

A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...

CVE-2025-60447

A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...

CVE-2025-60447

A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...

PT-2025-40525

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.19 Description A stored Cross-Site Scripting XSS issue has been identified. The vulnerability is located in the email template configuration component at the /admin/setting.php?action=mail API endpoint. This allows...

PT-2025-40460

Name of the Vulnerable Software and Affected Versions Emlog versions 2.5.21 and below Description Emlog is a website building system. A flaw exists where a malicious payload can be saved through the mail template settings, leading to stored cross-site scripting XSS. When an attacker saves malicio...

CVE-2025-60447: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...

CVE-2025-61597: Improper Neutralization of Input During Web Page Generation

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting XSS via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will...

FreeBSD : fetchmail -- potential crash when authenticating to SMTP server (21fba35e-a05f-11f0-a8b8-a1ef31191bc1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 21fba35e-a05f-11f0-a8b8-a1ef31191bc1 advisory. Matthias Andree reports: fetchmail's SMTP client, when configured to authenticate, is susceptible to a...

CVE-2025-61600

CVE-2025-61600 affects Stalwart mail server: versions 0.13.3 and earlier have an unbounded memory allocation vulnerability in the IMAP protocol parser due to missing validation in several state handlers, potentially allowing remote attackers to exhaust server memory and trigger OOM, causing a den...

CVE-2025-61600 Unbounded Memory Allocation in Stalwart IMAP parser

Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory OOM killer and causing a denial of...

Microsoft 365 Direct Send Abuse

The Rapid7 MDR team has observed a significant rise in the number of threat actors leveraging a lesser-known feature within Microsoft 365 called Direct Send. Rapid7 encourages organizations to immediately review their authenticated mail flow configurations, specifically related to Microsoft 365...

CVE-2025-53881

A UNIX Symbolic Link Symlink Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1...

CVE-2025-59742 Multiple vulnerabilities in AndSoft's e-TMS

SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACKREQUESTFRMSQL.ASP'...

CVE-2025-53881 SUSE-specific logrotate configuration allows escalation from mail user/group to root

A UNIX Symbolic Link Symlink Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1...

CVE-2025-53881 SUSE-specific logrotate configuration allows escalation from mail user/group to root

A UNIX Symbolic Link Symlink Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1...

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

...

PT-2025-40351

Name of the Vulnerable Software and Affected Versions exim versions prior to 4.98.2-lp156.248.1 Description A flaw exists in the exim package related to a UNIX Symbolic Link Symlink Following vulnerability within the logrotate configuration. This issue allows for privilege escalation from the mai...

CVE-2025-53881: UNIX Symbolic Link (Symlink) Following

A UNIX Symbolic Link Symlink Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1...

Stalwart security vulnerabilities

stalwart is a versatile email and collaboration server open-sourced by Stalwart Labs. A security vulnerability exists in Stalwart 0.13.3 and earlier versions, which stems from a lack of validation checks in multiple state handlers in the IMAP protocol parser, which could lead to an unbounded memo...

PT-2025-40430

Name of the Vulnerable Software and Affected Versions Stalwart versions 0.13.3 and below Description Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory,...