CVE-2021-27182

CVE-2021-27182 describes an IFRAME injection vulnerability in MDaemon Webmail (WorldClient) prior to version 20.0.4. The issue can be triggered via an email message and allows an attacker to execute actions with the privileges of the affected user, highlighting a client-side/iframe-based trust bo...

CVE-2021-27183

MDaemon Webmail before 20.0.4 contains an Arbitrary File Write vulnerability exploitable via Remote Administration. An attacker can create new files anywhere on the filesystem or modify existing files, with potential to achieve Remote Code Execution. Technical details across CNVD/CNNVD entries co...

CVE-2021-27180

MDaemon Webmail (WorldClient) on versions before 20.0.4 has a reflected XSS vulnerability exploitable via a GET request . The flaw can allow an attacker to perform actions with the privileges of the attacked user, with a NETWORK attack vector , UI required , and I/L/C/L/A impacts as described by ...

CVE-2022-29976

CVE-2022-29976 concerns an Authenticated Reflected Cross‑site Scripting in Alt‑N MDaemon prior to 22.0.0, arising from insufficient validation of user input in the BCC parameter. An attacker with access to MDaemon could trigger JavaScript execution in a victim’s browser. The CVSS data in the prov...

CVE-2021-27181

CVE-2021-27181 affects MDaemon before 20.0.4. Remote Administration allows manipulation of the anti-CSRF token via a crafted URL, enabling an attacker to trick an authenticated user into performing actions with the user’s privileges. Exploitation requires user interaction (visiting a malicious pa...

CVE-2022-29975

CVE-2022-29975 is an authenticated reflected Cross-Site Scripting vulnerability in MDaemon prior to 22.0.0. The issue arises from insufficient data validation/filtering of user-supplied and output data via the CC parameter, allowing an attacker with valid credentials to inject script that could e...