Skip to content
OpenAdvisories

Vendor

Alinto

10 known vulnerabilities.

Alinto at a glance

Last 12 months
7
Critical · all time
0
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 2 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 3 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202630
Apr 202600
Mar 202620
Feb 202610
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202510
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

SOGo 8 SOGo Webmail 1 SOPE 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • High 8.3
    CVE-2026-93453 Public exploit

    SOGo before 5.12.11 Password Reset Token Interception via Origin Header

    SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 8.1
    CVE-2026-8851

    SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint

    SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the …

    Alinto SOGo Webmail sogo sogo Debian Ubuntu
  • High 7.1
    CVE-2026-46446

    SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This …

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.1
    CVE-2026-46445

    SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

    Alinto SOGo sogo sogo Debian Ubuntu
  • Low 2.0
    CVE-2026-33550

    SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits ins…

    Alinto SOGo sogo sogo Debian Ubuntu
  • Medium 6.4
    CVE-2025-71276

    SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.

    Alinto SOGo sogo sogo Debian Ubuntu
  • Medium 4.3
    CVE-2026-3054

    Alinto SOGo cross site scripting

    A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The …

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.5
    CVE-2025-53603

    In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo…

    Alinto SOPE sogo sope Debian Ubuntu
  • Low 3.5
    CVE-2022-4556 Public exploit

    Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

    A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument…

    Alinto SOGo sogo sogo Debian Ubuntu
  • Low 3.5
    CVE-2022-4558

    Alinto SOGo Folder/Mail NSString+Utilities.m cross site scripting

    A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It …

    Alinto SOGo sogo sogo Debian Ubuntu