Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-40632

Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.

Published

2025-05-16T11:15:45.847

Last Modified

2025-10-09T19:31:29.610

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application icewarp mail_server 11.4.0 Yes
References