Advisories · Technology
Smartertools Smartermail.
Every CVE that names Smartertools Smartermail among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
- Smartertools Smartermail
- Authentication bypass
- CVSS 5.3 Medium
SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
- Smartertools Smartermail
- Cross-site scripting (XSS)
- CVSS 8.6 High
SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
- Smartertools Smartermail
- Code injection
- CVSS 7.2 High
Cross-site scripting in SmarterTools SmarterMail
- SmarterTools SmarterMail
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion
- SmarterTools SmarterMail
- CWE-706
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
- SmarterTools SmarterMail
- Authentication bypass
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
- SmarterTools SmarterMail
- Authentication bypass
- CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
Upload Arbitrary Files
- SmarterTools SmarterMail
- Unrestricted file upload