What is CVE-2025-40632?

CVE-2025-40632 is a medium-severity vulnerability in Icewarp Mail Server, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-05-16.

How severe is CVE-2025-40632?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2025-40632 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Icewarp Mail Server

CVE-2025-40632

Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (8.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Icewarp Mail Server — versions 11.4.0
Icewarp Mail_server — versions 11.4.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve-coordination@incibe.es (Third Party Advisory)

Frequently asked questions

What is CVE-2025-40632?: CVE-2025-40632 is a medium-severity vulnerability in Icewarp Mail Server, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-05-16.
How severe is CVE-2025-40632?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2025-40632 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.