CVE-2023-52269

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vipercalling/XSSsecurityGateway/blob/main/findingExploit, Third Party Advisory
https://mdaemon.com/pages/security-gatewayProduct
https://github.com/vipercalling/XSSsecurityGateway/blob/main/findingExploit, Third Party Advisory
https://mdaemon.com/pages/security-gatewayProduct

Timeline

Published: Dec 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-52279.8Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2023-522716.5The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via a CVE-2023-522746.1member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.CVE-2023-522752.1Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.enc CVE-2023-522777.8Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have CVE-2023-52284.8The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege us CVE-2023-522845.5Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for CVE-2023-522857.5ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.CVE-2023-522867.5Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_CVE-2023-522887.5An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET re CVE-2023-522897.5An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST r CVE-2023-52294.8The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perfo