Afterlogic Aurora
6 CVEs affecting Afterlogic Aurora. Latest disclosed: 2025-10-31. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26293 | Critical | 9.8 | 2021-03-04 | An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new fil… |
CVE-2021-26294 | High | 7.5 | 2021-03-07 | An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings… |
CVE-2019-19129 | Medium | 6.1 | 2019-11-26 | Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name. |
CVE-2019-16238 | Medium | 6.1 | 2019-09-12 | Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login. |
CVE-2017-14597 | Medium | 4.8 | 2017-09-19 | AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain. |
CVE-2025-12460 | | 2025-10-31 | An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript… |