CVE-2007-5290 Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP bef...
MediumCVSS 4.3
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| afterlogic mailbee webmail | All versions | No fix listed |
| afterlogic mailbee webmail | = 3.1 | No fix listed |
| afterlogic mailbee webmail | = 3.2 | No fix listed |
| afterlogic mailbee webmail | = 3.3 | No fix listed |
| afterlogic mailbee webmail | = 3.4 | No fix listed |
References
- 20071005 Reporting Vulnerable Public Web mail mailing-list
- 37649 vdb-entry
- 37650 vdb-entry
- 27073 third-party-advisory vendor-advisory
- 25942 vdb-entry
- 1018783 vdb-entry
- ADV-2007-3450 vdb-entry vendor-advisory
- mailbee-login-default-xss(36979) vdb-entry