Unrated severityNVD Advisory· Published Sep 24, 2007· Updated Jun 16, 2026

CVE-2007-5046

Description

Cross-site scripting (XSS) vulnerability in the Webmail interface for IceWarp Merak Mail Server before 9.0.0 allows remote attackers to inject arbitrary JavaScript via a javascript: URI in an attribute of an element in an email message body, as demonstrated by the onload attribute in a BODY element.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

IceWarp/Server2 versions
cpe:2.3:a:icewarp:merak_mail_server:8.9.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:icewarp:merak_mail_server:8.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:icewarp:merak_mail_server:8.9.2:*:*:*:*:*:*:*
IceWarp/Merak Mailllm-fuzzy
Range: <9.0.0

Patches

Vulnerability mechanics

References

secunia.com/advisories/26877nvdPatchVendor Advisory
www.mwrinfosecurity.com/publications/mwri_merak-webmail-xss-advisory_2008-09-17.pdfnvdVendor Advisory
www.securityfocus.com/bid/25708nvdVendor Advisory
osvdb.org/37428nvd
www.vupen.com/english/advisories/2007/3225nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000