CVE-2018-25269

MEDIUM

ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-25269. PoCs published by Usman Saeed.

AI-analyzed exploit summary The exploit demonstrates a Cross-Site Scripting (XSS) vulnerability in IceWarp WebMail client versions 11.0.0.0 and 10.3.4. It uses embedded SVG and object elements with base64-encoded payloads to trigger arbitrary JavaScript execution in the context of the victim's browser.

Description

ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.

Exploits (1)

exploitdb WORKING POC
by Usman Saeed · textwebappsphp
https://www.exploit-db.com/exploits/45974

The exploit demonstrates a Cross-Site Scripting (XSS) vulnerability in IceWarp WebMail client versions 11.0.0.0 and 10.3.4. It uses embedded SVG and object elements with base64-encoded payloads to trigger arbitrary JavaScript execution in the context of the victim's browser.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: IceWarp WebMail Client (versions 11.0.0.0 and 10.3.4)
No auth needed
Prerequisites: Victim must open a malicious email in IceWarp WebMail
devstral-2 · analyzed Apr 22, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-45974
https://www.exploit-db.com/exploits/45974
Product product
Official Product Homepage
http://www.icewarp.com/
Third Party Advisory third-party-advisory
VulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection
https://www.vulncheck.com/advisories/icewarp-cross-site-scripting-via-email-html-injection

Scores

CVSS v3 6.1
EPSS 0.0023
EPSS Percentile 13.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
icewarp/icewarp 11.0.0.0
icewarp/ICEWARP Client 10.3.4
icewarp/ICEWARP Client 11.0.0.0
Published Apr 22, 2026
Tracked Since Apr 22, 2026