Vulnerabilities

TI-2025-11433 CVE-2025-12460 · GHSA-vc68-c4h2-5g4j

Stored XSS vulnerability in Afterlogic Aurora webmail

LOW 24

An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00444 Published 2025-10-31 No fix listed CWE-79

TI-2023-23121 CVE-2023-43176 · GHSA-fg54-49f9-xp8r

A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to…

HIGH 73

A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01585 Published 2023-10-03 No fix listed CWE-502

TI-2021-08128 CVE-2021-26294 · GHSA-v4m8-qvh3-jm6c

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9.

MEDIUM 50

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.16899 Published 2021-03-07 No fix listed CWE-22

TI-2021-08127 CVE-2021-26293 · GHSA-77v9-4x76-g7mj

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3…

MEDIUM 52

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0711 Published 2021-03-04 No fix listed CWE-22

TI-2019-13802 CVE-2019-19129 · GHSA-9ppr-4hfx-mxgv

Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.

LOW 29

Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00802 Published 2019-11-26 No fix listed CWE-79

TI-2019-12220 CVE-2019-16238 · GHSA-j79v-j722-m7gr

Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session…

LOW 29

Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00934 Published 2019-09-12 No fix listed CWE-79

TI-2017-10698 CVE-2017-14597 · GHSA-5qgj-c6mc-6chj

AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field…

LOW 23

AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00516 Published 2017-09-19 No fix listed CWE-79

TI-2012-02245 CVE-2012-2587 · GHSA-9gxx-j3j6-fx26

Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME e…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01319 Published 2012-08-12 No fix listed CWE-79

TI-2009-04499 CVE-2009-4743 · GHSA-2fcr-q238-wpp8

Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01524 Published 2010-03-26 No fix listed CWE-79

TI-2008-00601 CVE-2008-0631 · GHSA-853q-qqmx-f5hg

Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to…

LOW 26

Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files via the SaveToDisk method, or (2) modify files via the AddStringToFile method.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03556 Published 2008-02-06 No fix listed CWE-20

TI-2008-00308 CVE-2008-0333 · GHSA-v7f2-x42c-c3gv

Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee…

LOW 36

Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.11659 Published 2008-01-17 No fix listed CWE-22

TI-2007-05090 CVE-2007-5290 · GHSA-7xv5-3986-m893

Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow re…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03816 Published 2007-10-09 No fix listed CWE-79

TI-2007-01982 CVE-2007-2061 · GHSA-qx7f-jwmh-xhcv

Cross-site scripting (XSS) vulnerability in check_login.asp in AfterLogic MailBee WebMail…

LOW 24

Cross-site scripting (XSS) vulnerability in check_login.asp in AfterLogic MailBee WebMail Pro 3.4 allows remote attackers to inject arbitrary web script or HTML via the username parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01995 Published 2007-04-18 No fix listed

Vulnerabilities

Filters