Afterlogic

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-43176 1Afterlogic 1Aurora Files Jul 9, 2026 Oct 3, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.
CVE-2021-26294 1Afterlogic 2Aurora Webmail Pro Jun 17, 2026 Mar 7, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as de...Show more An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).Show less
CVE-2021-26293 1Afterlogic 2Aurora Webmail Pro Jun 17, 2026 Mar 4, 2021 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is r...Show more An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.Show less
CVE-2019-19129 1Afterlogic 2Aurora Webmail Pro Jun 17, 2026 Nov 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.
CVE-2019-16238 1Afterlogic 1Aurora Jun 17, 2026 Sep 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.
CVE-2017-14597 1Afterlogic 2Aurora Webmail May 13, 2026 Sep 19, 2017 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.
CVE-2012-2587 1Afterlogic 1Mailsuite Pro Apr 29, 2026 Aug 12, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME e...Show more Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME element or (2) a SCRIPT element.Show less
CVE-2009-4743 1Afterlogic 1Webmail Pro Apr 29, 2026 Mar 26, 2010 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName...Show more Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName and (2) HistoryKey parameters.Show less
CVE-2008-0631 1Afterlogic 1Mailbee Objects Apr 23, 2026 Feb 6, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files via the SaveToDisk method, or (2) modify files via the AddStringToFile method.
CVE-2008-0333 1Afterlogic 1Mailbee Webmail Pro Apr 23, 2026 Jan 17, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the temp_filename parameter.
CVE-2007-5290 1Afterlogic 1Mailbee Webmail Apr 23, 2026 Oct 9, 2007 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow re...Show more Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.Show less
CVE-2007-2061 1Afterlogic 1Mailbee Webmail Apr 23, 2026 Apr 18, 2007 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in check_login.asp in AfterLogic MailBee WebMail Pro 3.4 allows remote attackers to inject arbitrary web script or HTML via the username parameter.