CVE-2025-63498

Alinto/SOGo cookie中的存储型XSS 研究者: Daniil Khomichenok, Alexander Klimenko 受影响版本 var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' 接受 XSS 注入作为参数值的登录 remember set-cookie 代码： if rememberLogin response addCookie: self cookieWithUsername: params...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340：SOGo Webmail 中的不安全的直接对象引用（IDOR漏洞） CVE ID: CVE-2025-50340 报告者：Milad Seddigh 产品：SOGo 受影响版本：v5.6.0 影响：不安全的直接对象引用（IDOR漏洞）→ 允许用户代表其他用户发送电子邮件。 摘要 在 SOGo Webmail...

CVE-2022-4556

CVE-2022-4556 - Stored XSS in SOGo Webmail v5.7.1 🧠 Summary A Stored Cross-Site Scripting XSS vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface , affecting version 5.7.1. An authenticated attacker could inject a malicious script that...

CVE-2025-63499

XSS Reflejado Dirigido en el parámetro theme Investigadores: Arseniy Poblaguev, Daniil Khomichenok Versiones afectadas = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Fecha: 02.12.2025 En el parámetro theme existe una vulnerabilidad de XSS Reflejado:...

ROS-20261002-73-0145

The vulnerability in Sogo is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-93453

CVE-2026-93453 — Envenenamiento del enlace de restablecimiento de contraseña de SOGo mediante la cabecera Origin Un exploit para una vulnerabilidad en la que SOGo construye el enlace de restablecimiento de contraseña que envía por correo a los usuarios directamente a partir de la cabecera Origin...

CVE-2023-48104

CVE-2023-48104 Inyección HTML en el cliente web Alinto/SOGo Proveedor del producto Alinto Tipo de vulnerabilidad Inyección HTML Versiones afectadas SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Descubridor Spiridonov Ivan/E1tex PoC Solo con fines de...

ROS-20261001-73-0055

The vulnerability of the management server’s software for collaborative work, SOGo, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...

ROS-20261001-73-0056

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

ROS-20261001-73-0057

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

CVE-2026-74864

sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...

Exploit for CVE-2026-93453

CVE-2026-93453 — SOGo Password Reset Link Poisoning via Origin...

EUVD-2026-82605

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

DEBIAN-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

UBUNTU-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453: Weak Password Recovery Mechanism for Forgotten Password

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

Linux Distros Unpatched Vulnerability : CVE-2026-93453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect...

CVE-2026-93453 SOGo before 5.12.11 Password Reset Token Interception via Origin Header

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...