Modoboa

17 CVEs across 5 Modoboa products. Browse Modoboa vulnerabilities, severities, and proof-of-concept exploits.

Modoboa products with known CVEs

ProductCVEs
Modoboa15
Modoboa/modoboa13
Installer1
Modoboa-Dmarc1
Modoboa/modoboa-Installer1
Modoboa CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-56780High7.52026-06-29Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administ…
CVE-2026-27602High7.22026-03-25Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=T…
CVE-2023-5690High8.82023-10-20Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-5689Medium5.42023-10-20Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-5688Medium5.42023-10-20Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CVE-2023-2228Medium6.82023-04-21Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-2227Critical9.12023-04-21Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-2160Medium6.32023-04-18Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
CVE-2023-0949Medium4.82023-02-22Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
CVE-2023-0860High7.52023-02-16Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
CVE-2023-0777Critical9.82023-02-10Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0519Medium5.42023-01-26Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0470Medium5.42023-01-26Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0438Medium6.52023-01-23Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0406Medium4.32023-01-19Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2023-0398Medium6.52023-01-19Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CVE-2019-19702High7.52019-12-10The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp…