Medium severity6.1NVD Advisory· Published Mar 23, 2026· Updated May 8, 2026
CVE-2026-32851
CVE-2026-32851
Description
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*+ 2 more
- cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*range: <10.55
- (no CPE)range: <10.55
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
5- karmainsecurity.com/KIS-2026-05nvdExploitThird Party Advisory
- mailenable.com/Standard-ReleaseNotes.txtnvdRelease Notes
- www.mailenable.comnvdProduct
- www.mailenable.com/rss/article.aspnvdRelease Notes
- www.vulncheck.com/advisories/mailenable-reflected-xss-via-freebusy-aspx-startdate-parameternvd
News mentions
0No linked articles in our index yet.