CVE-2025-63498
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
SOGo 5.12.3 is vulnerable to Cross-Site Scripting (XSS) via the "userName" parameter. The vulnerability allows injection of malicious JavaScript code that can be executed in the victim's browser.
Risk Assessment
An attacker could hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of the victim. This may lead to compromise of email and calendar accounts.
Recommendation
Update SOGo to the latest version that fixes this vulnerability. Implement additional input validation and consider using security headers such as Content Security Policy.
Other vulnerabilities in SOGo
See all- CVE-2015-5395High
CVE-2015-5395 is a cross-site request forgery (CSRF) vulnerability in SOGo before version 3.1.0. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of the user.
- CVE-2026-93453High
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
- CVE-2026-39179Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
- CVE-2026-39178Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
- CVE-2026-8851High
SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.
- CVE-2026-46446High
SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- CVE-2026-46445High
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
Original NVD description (English source)
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS