25 results · Feed
-
High 8.3CVE-2026-93453 Public exploit
SOGo before 5.12.11 Password Reset Token Interception via Origin Header
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…
-
Medium 6.3
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via …
-
Medium 6.3
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via …
-
High 8.1
SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the …
-
High 7.1
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This …
-
High 7.1
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content emb…
-
Low 2.0
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits ins…
-
Medium 6.4
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
-
Medium 4.3
Alinto SOGo cross site scripting
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The …
-
Medium 6.1CVE-2025-63499 Public exploit
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
-
Medium 6.1CVE-2025-63498 Public exploit
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
-
Medium 6.1
Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via …
-
Medium 6.1
Alinto SOGo through 5.10.0 allows XSS during attachment preview.
-
Medium 6.1CVE-2023-48104 Public exploit
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive inform…
-
Low 3.5CVE-2022-4556 Public exploit
Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting
A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument…
-
Low 3.5
Alinto SOGo Folder/Mail NSString+Utilities.m cross site scripting
A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It …
-
Unscored —
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it recei…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.…
-
Unscored —
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive i…
-
Unscored —
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote…
-
Unscored —
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number …