Medium severity6.1NVD Advisory· Published Apr 22, 2026· Updated Apr 29, 2026
CVE-2018-25269
CVE-2018-25269
Description
ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.exploit-db.com/exploits/45974nvdExploitVDB Entry
- www.vulncheck.com/advisories/icewarp-cross-site-scripting-via-email-html-injectionnvdThird Party Advisory
- www.icewarp.comnvdProduct
News mentions
1- ZDI-26-130: IceWarp collaboration Directory Traversal Information Disclosure VulnerabilityZero Day Initiative · Feb 25, 2026