CVE-2023-48974

Axigen WebMail is affected by a Cross-Site Scripting vulnerability (CVE-2023-48974) in versions prior to 10.3.3.61. The issue allows a remote attacker to escalate privileges by injecting a crafted script via the serverName_input parameter. Public exploit activity exists (e.g., Exploit-DB) and mai...

CVE-2020-26942

Axigen Mail Server vulnerability CVE-2020-26942 affects Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1. An unauthenticated attacker can send a setAdminPassword operation request to change the admin password, enabling unauthorized admin access. Impact is described as high ...

CVE-2023-23566

CVE-2023-23566 affects Axigen Mail Server v10.3.3.52, where a flaw in the 2-Step Verification flow allows an attacker to bypass 2FA when adding an account to a third‑party webmail service via IMAP/POP3, enabling mailbox access without a verification code. The underlying issue is bypassing 2FA dur...

CVE-2015-5379

Vulnerability (CVE-2015-5379) : AXIGEN Mail Server’s Ajax WebMail interface (actions.hsp) before version 9.0 is vulnerable to cross-site scripting via crafted HTML attachments viewed in the WebMail “View attachment” function. Root cause: attachments in the Ajax WebMail view execute script/HTML, e...

CVE-2025-68643

Axigen Mail Server prior to 10.5.57 is affected by a stored XSS in the timeFormat account preference. The vulnerability allows an attacker to inject a malicious JavaScript payload into timeFormat, which is later loaded from storage and inserted into the DOM when the WebMail interface is accessed,...

CVE-2012-2592

CVE-2012-2592 affects Axigen Mail Server 8.0.1 and is a Cross-site Scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML via the body of an email. Connected sources confirm the affected product and vulnerability class, but do not provide a patch version or remedi...

CVE-2025-68722

Axigen Mail Server vulnerable to CSRF in WebAdmin (CVE-2025-68722). Affected: versions before 10.5.57 and 10.6.x before 10.6.26. Issue: improper handling of the _s (breadcrumb) parameter allows GET-based state-changing actions immediately after administrator login by processing base64-encoded com...

CVE-2025-68721

Axigen Mail Server prior to version 10.5.57 is affected by an improper access control in the WebAdmin interface. A delegated admin account with zero permissions can bypass access checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts), enabling viewing, dow...

CVE-2025-68723

Axigen Mail Server before 10.5.57 contains multiple stored XSS in the WebAdmin interface. The three vulnerable areas are: (1) log file name parameter on the Local Services Log page, (2) certificate file content in the SSL Certificates View Usage feature, and (3) the Certificate File name paramete...