CVE-2018-25269

MEDIUM

ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection

Title source: cna
STIX 2.1

Description

ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.

Exploits (1)

exploitdb WORKING POC
by Usman Saeed · textwebappsphp
https://www.exploit-db.com/exploits/45974

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-45974
https://www.exploit-db.com/exploits/45974
Product product
Official Product Homepage
http://www.icewarp.com/
Third Party Advisory third-party-advisory
VulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection
https://www.vulncheck.com/advisories/icewarp-cross-site-scripting-via-email-html-injection

Scores

CVSS v3 6.1
EPSS 0.0003
EPSS Percentile 7.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
icewarp/icewarp 11.0.0.0
icewarp/ICEWARP Client 10.3.4
icewarp/ICEWARP Client 11.0.0.0
Published Apr 22, 2026
Tracked Since Apr 22, 2026