CVE-2024-11182

5.3 mediumKEVEPSS 33%

Medium (5.3) in MDaemon Email Server. In CISA KEV since 2025-05-19. EPSS 33% chance of exploitation in the next 30 days.

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 33% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2025-05-19, due 2025-06-09
CWE: CWE-79
Published: 2024-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mdaemon:mdaemon

References

https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11182

Check your stack JSON