CVE-2024-11182

🔥 Known Exploited (CISA KEV)MEDIUM

5.3

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-11-15

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

Affected Platforms (CPE)

📦

Mdaemon

< 24.5.1

References & Advisories

🔗 https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11182

Related Vulnerabilities

CVE-2025-610847.1

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of S...

CVE-2025-39295.3

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail...

CVE-2023-522694.8

MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrat...

CVE-2022-372385.4

MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest pa...