CVE-2018-25269

medium

Published 2026-04-22 · Modified 2026-05-26

CVSS v3

6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2

—

VIR risk

6.1

Description

ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.

Predictions

Exploit likelihood

71%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Application impact

Vendor	Product	Versions	Fixed
icewarp	icewarp	`11.0.0.0`

References

http://www.icewarp.com/
https://www.exploit-db.com/exploits/45974
https://www.vulncheck.com/advisories/icewarp-cross-site-scripting-via-email-html-injection

CWEs

CWE-79

Verify integrity in audit chain (admin only). AS-IS.