Alinto

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

Alinto records in CISA KEV

No Alinto vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Sogo 15 records MEDIUM Sogo Web Mail 1 record LOW

Records

15 records in Sogo · all components

TI-2025-39345 CVE-2025-63499 · GHSA-mrxw-g8fq-xg2c

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

MEDIUM 60

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00318 Published 2025-12-04 No fix listed CWE-79

TI-2025-39344 CVE-2025-63498 · GHSA-5mj7-xm92-5p4m

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

MEDIUM 60

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00305 Published 2025-11-24 No fix listed CWE-79

TI-2026-02638 CVE-2026-3054 · GHSA-47ph-5j6m-fmgx

Alinto SOGo cross site scripting

MEDIUM 57

A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00454 Published 2026-02-24 No fix listed CWE-79

TI-2015-04539 CVE-2015-5395 · GHSA-79jp-f6c4-wq28

Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00894 Published 2017-09-20 No fix listed CWE-352

TI-2016-05311 CVE-2016-6188 · GHSA-5wc3-v5wf-mg8q

Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory…

LOW 33

Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02156 Published 2017-02-03 No fix listed CWE-399

TI-2016-05314 CVE-2016-6191 · GHSA-mcp4-fq7j-35pr

Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01203 Published 2017-02-17 No fix listed CWE-79

TI-2014-08071 CVE-2014-9905 · GHSA-h4jq-99w5-gpv5

Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01223 Published 2017-02-17 No fix listed CWE-79

TI-2023-26033 CVE-2023-48104 · GHSA-x4j2-fh47-r6r6

Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.

LOW 29

Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01031 Published 2024-01-16 No fix listed CWE-79

TI-2024-16162 CVE-2024-24510 · GHSA-3x4h-m49h-pxr3

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker…

LOW 28

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00483 Published 2024-09-09 No fix listed CWE-79

TI-2022-04162 CVE-2022-4558 · GHSA-r8x7-gmq5-6256

Alinto SOGo Folder/Mail NSString+Utilities.m cross site scripting

LOW 28

A vulnerability was found in Alinto SOGo up to 5.7.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00612 Published 2022-12-16 No fix listed CWE-707

TI-2022-04160 CVE-2022-4556 · GHSA-vxr5-ghr8-4787

Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

LOW 28

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00612 Published 2022-12-16 No fix listed CWE-707

TI-2025-43399 CVE-2025-71276 · GHSA-c38q-j2vf-4r9p

SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.

LOW 27

SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00143 Published 2026-03-22 Fixed in 5.12.5 CWE-79

TI-2024-22795 CVE-2024-34462 · GHSA-6m2f-g987-jc22

Alinto SOGo through 5.10.0 allows XSS during attachment preview.

LOW 27

Alinto SOGo through 5.10.0 allows XSS during attachment preview.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00348 Published 2024-05-04 No fix listed CWE-79

TI-2016-05312 CVE-2016-6189 · GHSA-px99-x547-mjjw

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote…

LOW 23

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01412 Published 2017-02-17 No fix listed CWE-184

TI-2026-25941 CVE-2026-33550 · GHSA-9x6p-jf26-xmx7

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too…

LOW 12

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.0014 Published 2026-03-22 Fixed in 5.12.5 CWE-308

Open these records in search →

Critical	0
High	6
Medium	14
Low	1
No CVSS	0