Unrated severityNVD Advisory· Published Mar 23, 2026· Updated Mar 24, 2026
MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter
CVE-2026-32852
Description
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<10.55+ 1 more
- (no CPE)range: <10.55
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
5- karmainsecurity.com/KIS-2026-05mitretechnical-descriptionexploit
- www.mailenable.com/rss/article.aspmitrevendor-advisorypatch
- www.vulncheck.com/advisories/mailenable-reflected-xss-via-freebusy-aspx-startdate-parametermitrethird-party-advisory
- mailenable.com/Standard-ReleaseNotes.txtmitrerelease-notes
- www.mailenable.commitreproduct
News mentions
0No linked articles in our index yet.