Stored Cross-Site Scripting in Axigen Mail Server
CVE-2025-68643
What is CVE-2025-68643?
The Axigen Mail Server prior to version 10.5.57 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability that arises in the management of the timeFormat account preference parameter. Exploitation of this vulnerability requires a two-stage approach: first, an attacker must inject a malicious JavaScript payload into the timeFormat setting by leveraging a separate security flaw or using stolen credentials. In the second stage, upon the targeted user's login to the WebMail interface, the compromised timeFormat value is retrieved unsanitized from the database and integrated into the Document Object Model (DOM), resulting in the execution of the injected script. This vulnerability poses significant risks to users' data and overall security.