CVE-2021-27182

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/chudyPB/MDaemon-AdvisoriesExploit, Third Party Advisory
https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/Release Notes, Vendor Advisory
https://github.com/chudyPB/MDaemon-AdvisoriesExploit, Third Party Advisory
https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/Release Notes, Vendor Advisory

Timeline

Published: Apr 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-271837.2An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerabil CVE-2021-271847.5Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), r CVE-2021-271859.8The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.CVE-2021-271867.5Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metric CVE-2021-271877.5The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Sav CVE-2021-271887.5The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five CVE-2021-271895.9The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation.CVE-2021-271905.4A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user sup CVE-2021-271917.5The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker coul CVE-2021-271927.8Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain admini CVE-2021-271939.8Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacke CVE-2021-271948.8Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to ga