CVE-2018-25269

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-252709.8ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invokiCVE-2018-252715.5Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively loCVE-2018-252729.8ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commanCVE-2018-252736.2CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payloCVE-2018-252746.2InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciouslCVE-2018-252756.2Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized inpuCVE-2018-252765.5RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized CVE-2018-252776.2PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string CVE-2018-252786.2PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized inpCVE-2018-252796.2jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a mCVE-2018-252805.5Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by suCVE-2018-252815.5iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload
CVE-2018-25269: Medium severity, CVSS 6.1 | Vulnix