CVE-2012-2571

WinWebMail Server 3.8.1.6 - Cross-Site Scripting via Email Message Body

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-2571. PoCs published by loneferret.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in WinWebMail Server 3.8.1.6 by sending a malicious email with a JavaScript payload. The payload is injected into the email body and executed when the victim views the email.

Description

Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property in the STYLE attribute of an arbitrary element, (4) a crafted SRC attribute of an IFRAME element, or (5) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.

Exploits (1)

exploitdb WORKING POC VERIFIED
by loneferret · pythonwebappswindows
https://www.exploit-db.com/exploits/20366

This exploit demonstrates a stored XSS vulnerability in WinWebMail Server 3.8.1.6 by sending a malicious email with a JavaScript payload. The payload is injected into the email body and executed when the victim views the email.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WinWebMail Server 3.8.1.6
Auth required
Prerequisites: Valid credentials for the SMTP server · Network access to the SMTP server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/20366/

Scores

EPSS 0.0132
EPSS Percentile 67.0%

Details

CWE
CWE-79
Status published
Products (1)
winwebmail/winwebmail_server 3.8.1.6
Published Aug 12, 2012
Tracked Since Feb 18, 2026