Reflected XSS Vulnerability in MailEnable Address Book Functionality

CVE-2025-34402

What is CVE-2025-34402?

A reflected cross-site scripting (XSS) vulnerability exists in MailEnable versions before 10.54 that affects the FieldCc parameter of the AddressBook.aspx page. Due to inadequate sanitization of the FieldCc input during GET requests, an attacker can inject malicious JavaScript code into the response returned by the server. This exploit allows a remote attacker to execute arbitrary JavaScript in a victim’s browser when attempting to send an email. Consequences of successful exploitation include the potential for victims to be redirected to harmful sites, theft of non-HttpOnly cookies, and unauthorized actions taken on behalf of the authenticated user.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References