CVE-2025-34425
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
MailEnable versions prior to 10.54 contain a reflected XSS vulnerability in the WindowContext parameter of /Mondo/lang/sys/Forms/MAI/compose.aspx. The WindowContext value is not properly sanitized and is reflected within a script context, allowing an attacker to inject arbitrary JavaScript.
Risk Assessment
An attacker can hijack an authenticated user's session, redirect them to malicious sites, steal non-HttpOnly cookies, and perform actions on their behalf.
Recommendation
Update MailEnable to version 10.54 or later, which includes the fix.
Other vulnerabilities in MailEnable
See all- CVE-2025-44148Critical
Cross Site Scripting (XSS) vulnerability in MailEnable before version 10 allows a remote attacker to execute arbitrary code via the failure.aspx component.
- CVE-2025-34423High
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The administrative executable attempts to load MEAIAU.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAIAU.DLL, which is then loaded on execution, resulting in attacker-controlled code running with the privileges of the process.
Original NVD description (English source)
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the WindowContext parameter of /Mondo/lang/sys/Forms/MAI/compose.aspx. The WindowContext value is not properly sanitized when processed via a GET request and is reflected within a <script> context in the JavaScript variable window.location, allowing an attacker to break out of the existing script and inject arbitrary JavaScript. A remote attacker can supply a crafted payload that terminates the existing ProcessContextSwitchResult() function, inserts attacker-controlled script, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link or attempts to send an email. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS