CVE-2025-63498

XSS almacenado en cookie Alinto/SOGo Investigadores: Daniil Khomichenok, Alexander Klimenko Versiones afectadas var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Código del set-cookie para recordar el inicio de sesión, que acepta inyecciones XSS...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Referencia directa a objetos insegura vulnerabilidad IDOR en SOGo Webmail ID de CVE: CVE-2025-50340 Reportero: Milad Seddigh Producto: SOGo Versiones afectadas: v5.6.0 Impacto: Referencia directa a objetos insegura vulnerabilidad IDOR → Permite al usuario enviar correos electrónic...

CVE-2022-4556

CVE-2022-4556 - SOGo Webmail v5.7.1 中的存储型XSS漏洞 🧠 摘要 在 SOGo Web 界面的身份偏好设置 部分的 fullName 字段中发现了一个存储型跨站脚本（XSS）漏洞，影响版本 5.7.1 。经过认证的攻击者可以注入恶意脚本，当任何用户（包括攻击者自身）访问邮件标签页时该脚本都会执行。 🆔 CVE 详情 CVE ID : CVE-2022-4556 CVSS v3.1 : 6.1 中等 向量 : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 漏洞类型 : 存储型 XSS OWASP WSTG-INPV-02 攻击...

CVE-2025-63499

XSS Reflejado Dirigido en el parámetro theme Investigadores: Arseniy Poblaguev, Daniil Khomichenok Versiones afectadas = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Fecha: 02.12.2025 En el parámetro theme existe una vulnerabilidad de XSS Reflejado:...

ROS-20261002-73-0145

The vulnerability in Sogo is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-93453

CVE-2026-93453 — Envenenamiento del enlace de restablecimiento de contraseña de SOGo mediante la cabecera Origin Un exploit para una vulnerabilidad en la que SOGo construye el enlace de restablecimiento de contraseña que envía por correo a los usuarios directamente a partir de la cabecera Origin...

CVE-2023-48104

CVE-2023-48104 Inyección HTML en el cliente web Alinto/SOGo Proveedor del producto Alinto Tipo de vulnerabilidad Inyección HTML Versiones afectadas SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Descubridor Spiridonov Ivan/E1tex PoC Solo con fines de...

ROS-20261001-73-0055

The vulnerability of the management server’s software for collaborative work, SOGo, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...

ROS-20261001-73-0056

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

ROS-20261001-73-0057

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

CVE-2026-74864

sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...

Exploit for CVE-2026-93453

CVE-2026-93453 — SOGo Password Reset Link Poisoning via Origin...

EUVD-2026-82605

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

DEBIAN-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

UBUNTU-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453: Weak Password Recovery Mechanism for Forgotten Password

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

Linux Distros Unpatched Vulnerability : CVE-2026-93453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect...

CVE-2026-93453 SOGo before 5.12.11 Password Reset Token Interception via Origin Header

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...