Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119761— Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Quick assessment

Affected
Axigen Axigen Mail Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Axigen Mail Server WebMail 10.6.39 之前版本以及 10.7.1 版本中存在一个存储型跨站脚本（Stored XSS）漏洞。该漏洞允许未经身份验证的远程攻击者，通过在对话视图（conversation view）中注入未转义的发件人显示名称来执行脚本。攻击者可发送一封在“发件人”显示名称中包含 HTML 和脚本的邮件；当收件人打开该邮件所在文件夹时，脚本将被执行，从而导致邮箱内容被窃取或用户被重定向到恶意站点。

CVSS 6.1 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
Axigen Axigen Mail Server 10.5.0< 10.6.39 affected
10.7.0< 10.7.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119761

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name
Source: CVE Program / CVE List V5
Vulnerability Description
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Axigen Axigen Mail Server 10.5.0 ~ 10.6.39 -

II. Public POCs for CVE-2026-119761

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119761

请登录查看更多情报信息。

Other References for CVE-2026-119761 (4)

IV. Related Vulnerabilities

Same product: Axigen Mail Server
Same vendor: Axigen
Same weakness: CWE-79