Smartertools Smartermail
28 CVEs affecting Smartertools Smartermail. Latest disclosed: 2026-05-08. Critical: 5, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52691 | Critical | 10.0 | 2025-12-29 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially… |
CVE-2026-24423 | Critical | 9.8 | 2026-01-23 | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attack… |
CVE-2026-23760 | Critical | 9.8 | 2026-01-22 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoi… |
CVE-2021-32234 | Critical | 9.8 | 2021-11-17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. |
CVE-2019-7214 | Critical | 9.8 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when por… |
CVE-2019-7212 | High | 8.2 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. I… |
CVE-2026-7807 | High | 8.1 | 2026-05-08 | SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authen… |
CVE-2020-29548 | High | 8.1 | 2021-08-17 | An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, inject… |
CVE-2026-26930 | High | 7.2 | 2026-02-16 | SmarterTools SmarterMail before 9526 allows XSS via MAPI requests. |
CVE-2019-7213 | Medium | 6.5 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new fol… |
CVE-2021-43977 | Medium | 6.1 | 2021-11-17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. |
CVE-2021-32233 | Medium | 6.1 | 2021-07-06 | SmarterTools SmarterMail before Build 7776 allows XSS. |
CVE-2019-7211 | Medium | 6.1 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewi… |
CVE-2015-9276 | Medium | 6.1 | 2019-01-16 | SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a vict… |
CVE-2026-40514 | Medium | 5.9 | 2026-04-27 | SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys an… |
CVE-2023-48116 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment. |
CVE-2023-48115 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainTe… |
CVE-2023-48114 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the applicati… |
CVE-2021-40377 | Medium | 5.4 | 2021-09-08 | SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaSc… |
CVE-2026-25067 | Medium | 5.3 | 2026-01-29 | SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. Th… |