Threats tagged 'ghsa-rg92-ccrh-wg37'

Axigen Mail Server WebMail versions before 10.6.39 and 10.7.1 have a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated remote attackers to inject malicious scripts via unescaped sender display names in the conversation view. When a recipient opens the affected folder, the injected script executes, potentially leading to mailbox content theft or redirection.