Skip to content
OpenAdvisories

Vendor

Alinto

10 known vulnerabilities.

Products

SOGo 8 SOGo Webmail 1 SOPE 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.3
    CVE-2026-93453 Public exploit

    SOGo before 5.12.11 Password Reset Token Interception via Origin Header

    SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 8.1
    CVE-2026-8851

    SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint

    SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the …

    Alinto SOGo Webmail sogo sogo Debian Ubuntu
  • High 7.1
    CVE-2026-46446

    SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This …

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.1
    CVE-2026-46445

    SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.5
    CVE-2025-53603

    In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo…

    Alinto SOPE sogo sope Debian Ubuntu