Read the docs

cypht-org

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

cypht-org records in CISA KEV

No cypht-org vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-50271 CVE-2026-71981 · GHSA-46j6-w3hw-4r9x

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Priority MEDIUM 42

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00972 Published 2026-09-01 Fixed in 2.12.2 CWE-502
TI-2026-76820 CVE-2026-113583 · GHSA-w69r-hqpc-72f2

Stored DOM cross-site scripting in Cypht via external image notice

Priority LOW 24

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's exte…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00389 Published 2026-10-20 Fixed in 2.13.0 CWE-79
TI-2026-51628 CVE-2026-73524 · GHSA-r7q3-25g3-96cc

Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Priority LOW 23

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00407 Published 2026-09-01 Fixed in 2.12.2 CWE-79
Open these records in search →