CVE-2026-32850

MailEnable before 10.55 exposes a reflected XSS in the webmail ManageShares.aspx?SelectedIndex parameter. The input is embedded into dynamically generated JavaScript without proper sanitization, allowing remote attackers to execute arbitrary JavaScript in a victim’s browser via a crafted URL. CVS...