Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: cypht-org Clear all filters
TI-2026-76820 CVE-2026-113583 · GHSA-w69r-hqpc-72f2

Stored DOM cross-site scripting in Cypht via external image notice

Priority LOW 24

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's exte…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00389 Published 2026-10-20 Fixed in 2.13.0 CWE-79
TI-2026-51628 CVE-2026-73524 · GHSA-r7q3-25g3-96cc

Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Priority LOW 23

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00407 Published 2026-09-01 Fixed in 2.12.2 CWE-79
TI-2026-50271 CVE-2026-71981 · GHSA-46j6-w3hw-4r9x

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Priority MEDIUM 42

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00972 Published 2026-09-01 Fixed in 2.12.2 CWE-502