XSS in Afterlogic Aurora
CVE-2025-12460
An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (34.0th percentile) — read the EPSS interpretation.
Affected products
- Afterlogic Aurora — versions 0