CVE-2025-44148
Published: 03 June 2025
Summary
CVE-2025-44148 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Mailenable Mailenable. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
MailEnable versions prior to 10 are affected by a cross-site scripting vulnerability (CWE-79) in the failure.aspx component, tracked as CVE-2025-44148. The flaw permits remote injection of arbitrary script and is rated 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that successful exploitation can fully compromise the confidentiality, integrity, and availability of the mail server.
An unauthenticated attacker reachable over the network can supply malicious input to failure.aspx and achieve arbitrary code execution in the context of the MailEnable process. No user interaction or credentials are required, allowing the attacker to run commands, access data, or alter server behavior at will.
The listed references include the vendor domain mailenable.com and a public GitHub repository that reproduces the issue; neither source supplies explicit patch instructions or mitigation steps in the available data. The EPSS score is recorded at 0.1451 for both current and peak values, showing no material upward movement after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16734
Vulnerability details
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.