CVE-2024-11182

unknown KEV

Published 2025-05-19 · Modified 2025-05-19

CVSS v3

—

CVSS v2

—

VIR risk

1.5

Description

MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

CISA KEV

Vendor: MDaemon
Product: Email Server
Due date: 2025-06-09

Predictions

Exploit likelihood

99%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cisa-kev — https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html ; https://mdaemon.com/pages/downloads-critical-updates ; https://nvd.nist.gov/vuln/detail/CVE-2024-11182

Exploits

References

https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html ; https://mdaemon.com/pages/downloads-critical-updates ; https://nvd.nist.gov/vuln/detail/CVE-2024-11182

Verify integrity in audit chain (admin only). AS-IS.