Security Research

CVE-2025-44148 MailEnable Webmail Reflected XSS: Unsanitized state Parameter in failure.aspx

#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-44148 MailEnable Webmail Reflected XSS: Unsanitized state Parameter in failure.aspx

MailEnable Webmail’s failure.aspx writes the state parameter verbatim into the HTML when displaying the error page — attackers craft a state=<script>...</script> URL, the victim clicks, MailEnable writes it without sanitization, triggering reflected XSS — stealing sessions, cookies, launching phishing.

Unlock to view this content.