Advisories · Technology
mailcow-dockerized.
Every CVE that names mailcow-dockerized among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.4 High
mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 2.1 Low
mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 7.0 High
mailcow: dockerized vulnerable to stored XSS in user login history real_rip
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
mailcow: dockerized missing authorization on Forwarding Hosts delete action
- mailcow-dockerized
- Broken access control
- CVSS 8.9 High
mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 7.2 High
mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API
- mailcow-dockerized
- SQL injection
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template
- mailcow-dockerized
- Code injection
- CVSS 7.1 High
mailcow: dockerized vulnerable to password reset poisoning
- mailcow-dockerized
- Open redirect
- CVSS 3.8 Low
Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 7.6 High
Cross-site Scripting (XSS) via API Logs in mailcow: dockerized
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 6.6 Medium
Two-Factor Authentication (2FA) Bypass in mailcow: dockerized
- mailcow-dockerized
- CWE-697
- CVSS 6.1 Medium
mailcow Cross-site Scripting Vulnerability via Exception Handler
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
mailcow Path Traversal and Arbitrary Code Execution Vulnerability
- mailcow-dockerized
- Path traversal
- CVSS 8.8 High
Mailcow Docker Container Exposure to Local Network
- mailcow-dockerized
- CWE-610
- CVSS 4.7 Medium
mailcow ipixel flood attack leads to Denial of Service in admin page
- mailcow-dockerized
- Denial of service
- CVSS 8.3 High
mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation
- mailcow-dockerized
- Cross-site scripting (XSS)
- CVSS 8.8 High
Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords
- mailcow-dockerized
- Command injection
- CVSS 7.3 High
mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync
- mailcow-dockerized
- Command injection
- CVSS 8.1 High
mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
- mailcow-dockerized
- Information disclosure
- CWE-451
- CVSS 8.8 High
OS Command Injection in mailcow
- mailcow-dockerized
- Command injection