VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Apr 29, 2025· Updated Jun 17, 2026

CVE-2025-3929

CVE-2025-3929

Description

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Alt N/Email Server3 versions
    cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*range: >=20.0.0,<20.0.9
    • (no CPE)range: <=25.0.1
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.