Mailenable vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-44400 MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass aHigh 8.7 · May 8, 2026
• CVE-2025-34428 MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover.High 8.4 · Dec 10, 2025
• CVE-2025-34427 MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover.High 8.4 · Dec 10, 2025
• CVE-2025-34424 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34423 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34422 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34421 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34420 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34419 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34418 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34417 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34416 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 10, 2025
• CVE-2025-34396 MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution.High 8.5 · Dec 9, 2025
• CVE-2025-44148 Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx componentCritical 9.8 · Jun 3, 2025
• CVE-2022-42136 Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access.High 8.8 · Jan 13, 2023
• CVE-2019-12926 MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas.High 8.8 · Jul 8, 2019
• CVE-2019-12925 MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially readHigh 8.1 · Jul 8, 2019
• CVE-2019-12924 MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user.Critical 9.8 · Jul 8, 2019
• CVE-2015-9280 MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.Critical 10 · Jan 16, 2019
• CVE-2015-9278 MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-chanCritical 9.8 · Jan 16, 2019
• CVE-2015-9277 MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/..Critical 9.1 · Jan 16, 2019
• CVE-2008-1275 Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x anHigh 7.8 · Mar 10, 2008
• CVE-2008-1276 Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticateHigh 9 · Mar 10, 2008
• CVE-2008-1277 The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (High 9 · Mar 10, 2008
• CVE-2007-1301 Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to executeHigh 9 · Mar 6, 2007