CVE-2018-25269
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2018
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection
ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
ICEWARP Client
- Vendor
- icewarp
- Product
- ICEWARP Client
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 10.3.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 11.0.0.0 | affected | Unavailable | Unavailable | Unavailable | None listed |