PyPI package

modoboa

pkg:pypi/modoboa

Vulnerabilities (15)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-27602	Hig	7.2	< 2.7.1	2.7.1	Mar 25, 2026	Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can
CVE-2023-5690	Hig	8.8	< 2.2.2	2.2.2	Oct 20, 2023	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-5689	Med	5.4	< 2.2.2	2.2.2	Oct 20, 2023	Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-5688	Med	5.4	< 2.2.2	2.2.2	Oct 20, 2023	Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-2228	Med	6.8	< 2.1.0	2.1.0	Apr 21, 2023	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-2227	Cri	9.1	< 2.1.0	2.1.0	Apr 21, 2023	Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-2160	Med	6.3	< 2.1.0	2.1.0	Apr 18, 2023	Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-0949	Med	4.8	< 2.0.5	2.0.5	Feb 22, 2023	Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
CVE-2023-0860	Hig	7.5	< 2.0.4	2.0.4	Feb 16, 2023	Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
CVE-2023-0777	Cri	9.8	< 2.0.4	2.0.4	Feb 10, 2023	Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0519	Med	5.4	< 2.0.4	2.0.4	Jan 26, 2023	Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0470	Med	5.4	< 2.0.4	2.0.4	Jan 26, 2023	Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0438	Med	6.5	< 2.0.4	2.0.4	Jan 23, 2023	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0406	Med	4.3	< 2.0.4	2.0.4	Jan 19, 2023	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0398	Med	6.5	< 2.0.4	2.0.4	Jan 19, 2023	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

CVE-2026-27602HigMar 25, 2026
affected < 2.7.1fixed 2.7.1
Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can
CVE-2023-5690HigOct 20, 2023
affected < 2.2.2fixed 2.2.2
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-5689MedOct 20, 2023
affected < 2.2.2fixed 2.2.2
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-5688MedOct 20, 2023
affected < 2.2.2fixed 2.2.2
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-2228MedApr 21, 2023
affected < 2.1.0fixed 2.1.0
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-2227CriApr 21, 2023
affected < 2.1.0fixed 2.1.0
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-2160MedApr 18, 2023
affected < 2.1.0fixed 2.1.0
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-0949MedFeb 22, 2023
affected < 2.0.5fixed 2.0.5
Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
CVE-2023-0860HigFeb 16, 2023
affected < 2.0.4fixed 2.0.4
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
CVE-2023-0777CriFeb 10, 2023
affected < 2.0.4fixed 2.0.4
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0519MedJan 26, 2023
affected < 2.0.4fixed 2.0.4
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0470MedJan 26, 2023
affected < 2.0.4fixed 2.0.4
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0438MedJan 23, 2023
affected < 2.0.4fixed 2.0.4
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0406MedJan 19, 2023
affected < 2.0.4fixed 2.0.4
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0398MedJan 19, 2023
affected < 2.0.4fixed 2.0.4
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.