medium6.1Known exploited
CVE-2024-11182
MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-05-19. Federal due date: 2025-06-09.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mdaemon | Mdaemon | before 24.5.1 |