MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 19/05/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| mdaemon | < 24.5.1 | 24.5.1 |
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free