Medium severity · published May 16, 2025
CVE-2025-40632
Cross-site scripting (XSS) vulnerability in IceWarp Mail Server
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Icewarp Mail Server · Icewarp
11.4.0 · source: vendor
MS
Mail Server · Icewarp
11.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40632
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40632
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
More from Icewarp Mail Server
6.1
CVE-2025-40631
HTTP host header injection vulnerability in IceWarp Mail Server
6.1
CVE-2025-40630
Open redirection vulnerability in IceWarp Mail Server