What is CVE-2025-3929?

CVE-2025-3929 is a vulnerability in Mdaemon Email Server, classified under Cross-site Scripting. Published 2025-04-29.

Is CVE-2025-3929 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Mdaemon Email Server

CVE-2025-3929

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (35.9th percentile) — read the EPSS interpretation.

Affected products

Mdaemon Email Server — versions 0, 25.0.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

ARPSyndicate/cve-scores
fkie-cad/nvd-json-data-feeds

References

mdaemon.com/pages/downloads-critical-updates

Frequently asked questions

What is CVE-2025-3929?: CVE-2025-3929 is a vulnerability in Mdaemon Email Server, classified under Cross-site Scripting. Published 2025-04-29.
Is CVE-2025-3929 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.