CVE-2025-40632
Cross-site scripting (XSS) vulnerability in IceWarp Mail Server
- State
- Published
- Severity
- 2.0 Low
- Published
- May 16, 2025
- Updated
- May 16, 2025
- Reserved
- Apr 16, 2025
Description
Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | INCIBE |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Icewarp Mail ServerIcewarp |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.