$ cve CVE-2009-1467 JSON

CVE-2009-1467 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 4.1% (pctl 90)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	4.1% — more likely to be exploited than 90% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2009-05-05
Last modified	2026-06-16

Affected (2)

Vendor	Product
icewarp	email server
icewarp	webmail server

Public exploits

Source	Title	Date
exploit-db	IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting	2009-05-05
exploit-db	IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting	2009-05-05

References

→ the Explorer · watch your stack · NVD