CVE-2024-55492

Winmail Server 4.4 is vulnerable to fuser=%22%3E%3Csvg%20onload Cross Site Scripting XSS...

CVE-2024-55492

Winmail Server 4.4 is vulnerable to fuser=%22%3E%3Csvg%20onload Cross Site Scripting XSS...

CVE-2024-55492

Winmail Server 4.4 is vulnerable to fuser=%22%3E%3Csvg%20onload Cross Site Scripting XSS...

CVE-2024-55492

CVE-2024-55492 affects Winmail Server 4.4. The issue is a cross-site scripting (XSS) vulnerability via the f_user parameter containing a payload like %22%3E%3Csvg%20onload. Documented CVSS v3.1 base score 6.1 (Medium) with network attack vector, required user interaction, and changed scope; confi...

PT-2024-36529 · Unknown · Winmail Server

Name of the Vulnerable Software and Affected Versions: Winmail Server version 4.4 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It involves the f user variable and a specific payload %22%3E%3Csvg%20onload. This type of attack can allow an attacker to inject malicious...

Winmail Server 安全漏洞

Winmail Server is a server-side application used to provide mail services by China Huazhao Winmail Company. A security vulnerability exists in Winmail Server version 4.4, which stems from the inclusion of a cross-site scripting vulnerability...

CVE-2024-25501

An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter...

Code injection

An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter...

WinMail Security Vulnerability

Winmail is a server-side application used to provide email services by Suzhou Huamei Technology Winmail, a Chinese company. A security vulnerability exists in WinMail version v.7.1 and v.5.1 and earlier versions, which originated from a vulnerability that allows remote attackers to execute...

CVE-2024-25501

An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter...

CVE-2024-25501

CVE-2024-25501 concerns WinMail (versions 7.1, 5.1, and earlier). The vulnerability allows a remote attacker to execute arbitrary code by sending a crafted script to the email parameter. The impact is described as high confidentiality, integrity, and availability risks (per CVSS 3.1 metrics: AV:N...

CVE-2024-25501

An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter...

CVE-2020-23774

A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed...

CVE-2020-23776

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...

CVE-2020-23774

A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed...

CVE-2020-23776

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...

Cross site scripting

A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed...

Server side request forgery (ssrf)

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...

CVE-2020-23776

CVE-2020-23776 is an SSRF vulnerability affecting Winmail 6.5 in app.php (parameter key) when HTTPS is enabled. The issue allows an attacker to induce the server to make HTTP requests to a target URL by manipulating the HOST header in requests. Documented in multiple feeds (NVD/Red Hat/CVE lists)...

CVE-2020-23776

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...