CVE-2025-44148

An attacker exploits the vulnerable failure.aspx component, to which it is possible to submit a malicious payload without authentication and without user interaction on the server side. The injected XSS code is then executed in the context of the application, which according to the description can lead to arbitrary code execution (RCE). The attack is possible remotely over the network, without special privileges or complex conditions.

An attacker can execute arbitrary code in the context of the application or victim's browser, potentially leading to system takeover, data theft, or further lateral movement in the network.

MailEnable should be updated to version 10 or newer according to vendor information available at mailenable.com

MailEnable in all versions before version 10