CyberSec.Space Logo
Back to CVE Browser

CVE-2025-52691

🔥 Known Exploited (CISA KEV)CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-12-29
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Affected Platforms (CPE)

📦
Smartertools

Smartermail

< 100.0.9413

References & Advisories

🔗 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/
🔗 https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691

Related Vulnerabilities

CVE-2023-481165.4

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.

CVE-2023-481155.4

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when m...

CVE-2023-481145.4

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This...

CVE-2021-439776.1

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.