Skip to content
OpenAdvisories

Product · postalserver

postal

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-25529

    Postal has HTML injection / XSS in message view

    Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This…

    postalserver postal