CVE-2026-7807 | High | 8.1 | 2026-05-08 | SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authen… |
CVE-2026-40514 | Medium | 5.9 | 2026-04-27 | SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys an… |
CVE-2026-26930 | High | 7.2 | 2026-02-16 | SmarterTools SmarterMail before 9526 allows XSS via MAPI requests. |
CVE-2026-25067 | Medium | 5.3 | 2026-01-29 | SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. Th… |
CVE-2026-24423 | Critical | 9.8 | 2026-01-23 | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attack… |
CVE-2026-23760 | Critical | 9.8 | 2026-01-22 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoi… |
CVE-2020-36926 | High | 7.5 | 2026-01-16 | SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can… |
CVE-2025-52691 | Critical | 10.0 | 2025-12-29 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially… |
CVE-2023-48116 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment. |
CVE-2023-48115 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainTe… |
CVE-2023-48114 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the applicati… |
CVE-2022-24387 | Critical | 9.1 | 2022-03-14 | With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis… |
CVE-2022-24386 | High | 8.8 | 2022-03-14 | Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. |
CVE-2022-24385 | Medium | 6.5 | 2022-03-14 | A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.1401… |
CVE-2022-24384 | High | 8.8 | 2022-03-14 | Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. |
CVE-2021-43977 | Medium | 6.1 | 2021-11-17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. |
CVE-2021-32234 | Critical | 9.8 | 2021-11-17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. |
CVE-2021-40377 | Medium | 5.4 | 2021-09-08 | SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaSc… |
CVE-2020-29548 | High | 8.1 | 2021-08-17 | An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, inject… |
CVE-2021-32233 | Medium | 6.1 | 2021-07-06 | SmarterTools SmarterMail before Build 7776 allows XSS. |
CVE-2019-7214 | Critical | 9.8 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when por… |
CVE-2019-7213 | Medium | 6.5 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new fol… |
CVE-2019-7212 | High | 8.2 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. I… |
CVE-2019-7211 | Medium | 6.1 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewi… |
CVE-2015-9276 | Medium | 6.1 | 2019-01-16 | SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a vict… |
CVE-2017-14620 | Medium | 6.1 | 2017-09-30 | SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Sc… |
CVE-2012-2578 | | | 2012-09-19 | Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body… |
CVE-2011-4752 | | | 2011-12-16 | SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact… |
CVE-2011-4751 | | | 2011-12-16 | SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx, whi… |
CVE-2011-4750 | | | 2011-12-16 | Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attackers to inject arbitrary web script or HTML via cra… |
CVE-2011-2159 | | | 2011-05-20 | The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified imp… |
CVE-2011-2158 | | | 2011-05-20 | The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecif… |
CVE-2011-2157 | | | 2011-05-20 | The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages c… |
CVE-2011-2156 | | | 2011-05-20 | The SmarterTools SmarterStats 6.0 web server allows remote attackers to obtain directory listings via a direct request for the (1) Admin/, (2) Admin/Defaults/… |
CVE-2011-2155 | | | 2011-05-20 | Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, wh… |
CVE-2011-2154 | | | 2011-05-20 | login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes… |
CVE-2011-2153 | | | 2011-05-20 | Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier f… |
CVE-2011-2152 | | | 2011-05-20 | The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for (1) Client/frmVie… |
CVE-2011-2151 | | | 2011-05-20 | The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Client/frmUser.aspx, and (5) Login.aspx components in… |
CVE-2011-2150 | | | 2011-05-20 | The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attack… |
CVE-2011-2149 | | | 2011-05-20 | Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain par… |
CVE-2011-2148 | | | 2011-05-20 | Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and tr… |
CVE-2010-3486 | | | 2010-09-22 | Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slas… |
CVE-2010-3425 | | | 2010-09-16 | Cross-site scripting (XSS) vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote atta… |
CVE-2009-4995 | | | 2010-08-25 | Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script… |
CVE-2009-4994 | | | 2010-08-25 | Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web scrip… |
CVE-2008-1854 | | | 2008-04-16 | Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termin… |
CVE-2008-0872 | | | 2008-02-21 | Cross-site scripting (XSS) vulnerability in SmarterTools SmarterMail Enterprise 4.3 allows remote attackers to inject arbitrary web script or HTML via a STYLE… |
CVE-2004-2587 | | | 2004-12-31 | login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly du… |
CVE-2004-2586 | | | 2004-12-31 | Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files vi… |
CVE-2004-2585 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web s… |
CVE-2004-2584 | | | 2004-12-31 | frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rena… |
CVE-2004-2583 | | | 2004-12-31 | SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of sim… |