Reflected Cross-Site Scripting Vulnerability in MailEnable Software

CVE-2025-34407

What is CVE-2025-34407?

MailEnable versions prior to 10.54 exhibit a reflected XSS vulnerability within the theme parameter located in /Mondo/lang/sys/Forms/Statistics.aspx. An attacker can exploit this weakness by sending a specially crafted GET request that contains a malicious payload in the theme value. This payload manipulates the HTML response, breaking out of an existing iframe context to inject arbitrary JavaScript. As a result, when users click on the malicious link, they may inadvertently execute harmful scripts in their browser. This exploitation can lead to unauthorized actions being performed under the victim’s authenticated session, theft of cookies, and redirection to malicious websites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References