CVE-2025-3929
Stored XSS vulnerability in MDaemon Email Server
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Stored XSS vulnerability in MDaemon Email Server
An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
Reserved 2025-04-25 | Published 2025-04-29 | Updated 2025-04-29 | Assigner ESETCWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Matthieu Faou (ESET)
mdaemon.com/pages/downloads-critical-updates
Support options
