CVE-2019-12593

CVE-2019-12593 : IceWarp Mail Server versions up to 10.4.4 are affected by a Local File Inclusion (LFI) via webmail/calendar/minimizer/index.php?style=.., a directory traversal vulnerability. The underlying issue allows an attacker to read sensitive files from the server. Affected product is IceW...

CVE-2019-19265

IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 are affected by a cross-site scripting vulnerability in notes for contacts. The root cause is lack of proper validation of client data by the WEB application, enabling attacker-supplied content (e.g., manipulated vCard) to execute JavaScrip...

CVE-2021-36580

IceWarp Mail Server (IceWarp Server Deep Castle 2 Update 1, version 13.0.1.2) is vulnerable to an open redirect via the referer parameter. The Nuclei template CVE-2021-36580 confirms this open redirect, enabling potential phishing or unintended redirects. Remediation is to apply the latest securi...

CVE-2019-19266

IceWarp WebMail Server 12.2.0 and 12.1.x prior to 12.2.1.1 are affected by a Cross‑Site Scripting (XSS) vulnerability in object notes. The root cause is lack of proper validation of client‑side data by the WEB application, allowing injected JavaScript to execute when notes are displayed to users....

CVE-2023-39699

CVE-2023-39699 affects IceWarp Mail Server v10.4.5 via a Local File Inclusion (LFI) in the /calendar/minimizer/index.php component. The vulnerability allows an attacker to include or execute files from the server’s local filesystem. Documented impact is high (potential code execution/unauthorized...

CVE-2015-1503

CVE-2015-1503 affects IceWarp Mail Server versions prior to 11.2. A directory traversal vulnerability exists in the web interface: an attacker can read arbitrary server files via directory traversal sequences (.. and .../.. etc) in parameters to webmail/client/skins/default/css/css.php and to web...

CVE-2023-39700

IceWarp Mail Server v10.4.5 is affected by a reflected XSS via the color parameter in the webmail interface. The nuclei template describes unauthenticated attackers injecting malicious JavaScript to steal email session cookies and access sensitive communications. Remediation: upgrade to a version...

CVE-2020-27982

CVE-2020-27982 affects IceWarp WebMail 11.4.5.0 and is an XSS vulnerability exploitable via the language parameter (e.g., /webmail/?language=). The root cause is improper handling of the language parameter, enabling arbitrary JavaScript execution in a victim’s browser (session hijacking/defacemen...

CVE-2025-40630

IceWarp Mail Server ≤11.4.0 suffers an open redirect vulnerability. The issue is triggered by crafting malicious URLs that redirect users to arbitrary external domains (examples show vulnerable URL formats). Root cause is improper handling of target URLs leading to redirects. Affected product/ver...

CVE-2017-12844

IceWarp Mail Server 10.4.4 is affected by a Cross-site scripting (XSS) vulnerability in the admin panel. The flaw allows remote authenticated domain administrators to inject arbitrary web script or HTML via a specially crafted username. Documented impact is limited to injection into admin UI; no ...

CVE-2011-3579

IceWarp Web Mail vulnerability CVE-2011-3579 affects IceWarp WebMail (the web front-end of IceWarp Mail Server) prior to version 10.3.3. The issue is an XML External Entity (XXE) injection via an XML DOCTYPE with a SYSTEM entity, combined with an entity reference, that can allow remote attackers ...

CVE-2011-3580

IceWarp WebMail on IceWarp Mail Server before version 10.3.3 is affected by CVE-2011-3580, allowing remote attackers to disclose configuration/details by requesting the /server URI, triggering phpinfo. The advisory notes that the issue is fixed in 10.3.3; update to that version to remediate.

CVE-2020-14066

CVE-2020-14066 affects IceWarp Email Server 12.3.0.1. The issue permits remote attackers to upload JavaScript files that are dangerous for clients to access, indicating an insecure file-upload handling vulnerability. The connected documents corroborate the vulnerability description, but do not pr...

CVE-2020-14064

The vulnerability CVE-2020-14064 affects IceWarp Email Server 12.3.0.1 with an incorrect access control for user accounts. The connected documents provide no concrete exploit details or remediation specifics. No further technical details are available in the provided sources; monitor for updates ...

CVE-2018-7475

IceWarp Mail Server 12.0.3 is affected by a cross-site scripting (XSS) vulnerability in the webdav/ticket/ URIs. The issue, described in CVE-2018-7475, allows remote attackers to inject arbitrary web script or HTML. Public references confirm XSS in IceWarp Mail Server

CVE-2020-14065

CVE-2020-14065 affects IceWarp Email Server 12.3.0.1; documented vulnerability allows remote attackers to upload files and consume disk space, with impact described as high availability disruption. The available sources corroborate an unauthorized file upload path in IceWarp’s 12.3.0.1 release; n...

CVE-2018-16324

IceWarp Server 12.0.3.1 and earlier is affected by a cross-site scripting (XSS) vulnerability in the /webmail/ username field. The issue is confirmed in the CVE-2018-16324 entry and corroborated by NVD references, with CVSS Base Scores 4.3 (4.3) and 6.1 (3.0) indicating a network-exposed vulnerab...

CVE-2025-40631

CVE-2025-40631 describes an HTTP Host header injection affecting IceWarp Mail Server, version 11.4.0. By modifying the Host header and delivering a payload, arbitrary JavaScript can be executed on the loaded page when a user interacts with a malicious link (redirect). The vulnerability is tied to...

CVE-2025-40632

IceWarp Mail Server (v11.4.0) contains a Cross-Site Scripting (XSS) vulnerability where an attacker can modify the lastLogin cookie to inject JavaScript that executes when the page renders. Affected component is the web-facing handling of user data; the root cause is lack of proper filtering/esca...