Magicwinmail Winmail Server — known CVE vulnerabilities

Every CVE whose affected-product data names Magicwinmail Winmail Server, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2017-9846 — CVSS 8.8 (high): Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file…
• CVE-2018-5700 — CVSS 8.8 (high): Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php…
• CVE-2024-55492 — CVSS 6.1 (medium): Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).