CVE-2025-40632

2.0 lowEPSS 0.2%

Low (2.0) in icewarp mail server. EPSS 0.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

icewarp:mail_server

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server

Check your stack JSON