CVE-2020-23774

The CVE-2020-23774 entry concerns a reflected XSS in Winmail 6.5, specifically in tohtml/convert.php. The underlying issue is the ability to cause JavaScript execution via user-controlled input reflected in the response. Evidence from connected records confirms the affected software/component and...

CVE-2020-23776

CVE-2020-23776 is an SSRF vulnerability affecting Winmail 6.5 in app.php (parameter key) when HTTPS is enabled. The issue allows an attacker to induce the server to make HTTP requests to a target URL by manipulating the HOST header in requests. Documented in multiple feeds (NVD/Red Hat/CVE lists)...