The vulnerability of the download mechanism of the SmarterTools SmarterMail email server allows a perpetrator to execute arbitrary code.

The vulnerability of the attachment loading mechanism in the SmarterTools SmarterMail email server relates to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the SmarterTools SmarterMail mail server lies in the lack of protective measures for the website structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the SmarterTools SmarterMail mail server is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using MAPI requests...

SmarterMail < 100.0.9526 XSS (CVE-2026-26930)

The version of SmarterTools SmarterMail installed on the remote host is prior to 100.0.9526. It is, therefore, affected by a cross-site scripting vulnerability: - SmarterTools SmarterMail before build 9526 allows XSS via MAPI requests. CVE-2026-26930 Note that Nessus has not tested for this issue...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-11953link is external React Native Community CLI OS Command Injection Vulnerability CVE-2026-24423link is external SmarterTools SmarterMail Missing...

CVE-2026-24423: Missing Authentication for Critical Function

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

PT-2026-5795

Уязвимость почтового сервера SmarterTools SmarterMail связана с использованием имени с неправильной ссылкой. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, перехватить учетную запись пользователя...

PT-2026-5794

Уязвимость метода API ConnectToHub почтового сервера SmarterTools SmarterMail связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

EUVD-2008-0879

Malware in sbrugna...

EUVD-2019-16756

Malware in sbrugna...

EUVD-2021-19090

Malware in sbrugna...

CVE-2021-32234

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution...

CVE-2023-48116

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment...

Cross site scripting

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment...

SmarterTools SmarterMail Security Breach

SmarterTools SmarterMail is a set of mail server software from SmarterTools. The software supports spam filtering, statistics, Simple Mail Transfer Protocol SMTP authentication, and other features. A security vulnerability exists in SmarterTools SmarterMail versions 8495 through 8664, which stems...

CVE-2023-48116: Improper Neutralization of Input During Web Page Generation

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment...

Metasploit Weekly Wrap-Up

Authentication bypass in Wordpress Plugin WooCommerce Payments This week's Metasploit release includes a module for CVE-2023-28121 by h00die. This module can be used against any wordpress instance that uses WooCommerce payments 5.6.1. This module exploits an auth by-pass vulnerability in the...

SmarterTools SmarterMail Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution', 'Description' = %q This module exploits a...

Remote code execution

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution...

CVE-2021-32234

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution...

PT-2021-19677

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions 16.x through 100.x before 100.0.7803 Description: The issue allows remote code execution. Recommendations: For versions 16.x through 100.x before 100.0.7803, update to version 100.0.7803 or later to resolve t...