Modoboa
Products
3- Modoboa15 CVEspypi
- 1 CVE
- 1 CVE
Recent CVEs
17| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-0777 | Cri | 0.61 | 9.8 | 0.15 | Feb 10, 2023 | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. | ||
| CVE-2023-2227 | Cri | 0.56 | 9.1 | 0.44 | Apr 21, 2023 | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. | ||
| CVE-2023-5690 | Hig | 0.50 | 8.8 | 0.00 | Oct 20, 2023 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. | ||
| CVE-2023-0860 | Hig | 0.42 | 7.5 | 0.01 | Feb 16, 2023 | Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4. | ||
| CVE-2019-19702 | Hig | 0.42 | 7.5 | 0.01 | Dec 10, 2019 | The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the… | ||
| CVE-2026-27602 | Hig | 0.40 | 7.2 | 0.01 | Mar 25, 2026 | Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can… | ||
| CVE-2023-2228 | Med | 0.37 | 6.8 | 0.00 | Apr 21, 2023 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0. | ||
| CVE-2023-0438 | Med | 0.35 | 6.5 | 0.00 | Jan 23, 2023 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. | ||
| CVE-2023-0398 | Med | 0.35 | 6.5 | 0.00 | Jan 19, 2023 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. | ||
| CVE-2023-2160 | Med | 0.34 | 6.3 | 0.01 | Apr 18, 2023 | Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. | ||
| CVE-2023-5689 | Med | 0.28 | 5.4 | 0.01 | Oct 20, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. | ||
| CVE-2023-5688 | Med | 0.28 | 5.4 | 0.01 | Oct 20, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. | ||
| CVE-2023-0519 | Med | 0.28 | 5.4 | 0.01 | Jan 26, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4. | ||
| CVE-2023-0470 | Med | 0.28 | 5.4 | 0.01 | Jan 26, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4. | ||
| CVE-2023-0949 | Med | 0.24 | 4.8 | 0.01 | Feb 22, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5. | ||
| CVE-2023-0406 | Med | 0.21 | 4.3 | 0.00 | Jan 19, 2023 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. | ||
| CVE-2026-56780 | Hig | 0.00 | 7.5 | 0.00 | Jun 29, 2026 | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to… |
- risk 0.61cvss 9.8epss 0.15
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
- risk 0.56cvss 9.1epss 0.44
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
- risk 0.50cvss 8.8epss 0.00
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
- risk 0.42cvss 7.5epss 0.01
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
- risk 0.42cvss 7.5epss 0.01
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the…
- risk 0.40cvss 7.2epss 0.01
Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can…
- risk 0.37cvss 6.8epss 0.00
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
- risk 0.35cvss 6.5epss 0.00
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
- risk 0.35cvss 6.5epss 0.00
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
- risk 0.34cvss 6.3epss 0.01
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
- risk 0.21cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
- risk 0.00cvss 7.5epss 0.00
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to…