CVE-2024-11182

MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

MDaemon Email Server

CVSS

5.3Medium

ExploitationExploited in the wildAdded to KEV 19 May 2025CISA KEV

Exploit odds (EPSS)31.4%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Federal deadline9 Jun 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version.

Timeline

15 Nov 2024, 10:43 UTCPublishedCVE List
19 May 2025Added to CISA KEVCISA KEV

Description

MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

Text from CVE List

Affected versions 2

Email Serveraffected: all versions through 24.5.0CVE List
Email Serverunaffected: 24.5.1CVE List