CVE-2025-40632 — Cross-site scripting (XSS) vulnerability in IceWarp Mail Server

CVE-2025-40632

Cross-site scripting (XSS) vulnerability in IceWarp Mail Server PUBLISHED

Description (CNA)

Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.

Affected (CNA)

Vendor / product	Versions
Icewarp / Icewarp Mail Server	affected 11.4.0

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.