CVE-2007-5290

Afterlogic Mailbee Webmail - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.

Exploits (2)

exploitdb WRITEUP VERIFIED

by Ivan Sanchez · textwebappsphp

https://www.exploit-db.com/exploits/30642

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by Ivan Sanchez · textwebappsphp

https://www.exploit-db.com/exploits/30641

View Code ZIP pw:eip

References (8)

[Mailing List] http://marc.info/?l=bugtraq&m=119161078031690&w=2

[Third Party Advisory, VDB Entry] http://osvdb.org/37649

[Vendor Advisory] http://secunia.com/advisories/27073

[Vendor Advisory] http://www.vupen.com/english/advisories/2007/3450

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/36979

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/25942

[Third Party Advisory, VDB Entry] http://osvdb.org/37650

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1018783

Scores

EPSS 0.0215

EPSS Percentile 84.1%

Classification

CWE

CWE-79

Status draft

Affected Products (7)

afterlogic/mailbee_webmail

afterlogic/mailbee_webmail

afterlogic/mailbee_webmail

afterlogic/mailbee_webmail

afterlogic/mailbee_webmail

afterlogic/mailbee_webmail

afterlogic/mailbee_webmail

Timeline

Published Oct 09, 2007

Tracked Since Feb 18, 2026