MediumCVSS 6.1
EPSS 0.29%
Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).
Vendor
magicwinmail vulnerabilities
3 published CVES affecting magicwinmail, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 3
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest magicwinmail CVEs
Newest publication first
-
-
HighCVSS 8.8 EPSS 3.3%
Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/class.ftpfolder.php) to move a .php file from the FTP folder into a web folder.
-
HighCVSS 8.8 EPSS 2.8%
Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.