What is the CVSS score of CVE-2025-44148?

CVE-2025-44148 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 11.5%.

Which versions of Mailenable are affected by CVE-2025-44148?

A critical vulnerability in MailEnable versions prior to v10 allows unauthenticated attackers to execute arbitrary code through the failure.aspx component, with public exploits already available.

Is there a public PoC exploit available for CVE-2025-44148?

Yes, a public proof-of-concept exploit is available for CVE-2025-44148. Prioritise patching immediately. EPSS: 11.5%.

How to fix or mitigate CVE-2025-44148?

Within 24 hours: Identify and inventory all MailEnable deployments and their versions; isolate affected systems from untrusted networks if running pre-v10 versions. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious requests to failure.aspx; disable or restrict access to the failure.aspx component if operationally feasible; apply input validation and output encoding at the application layer. Within 30 days: Upgrade to MailEnable v10 or later; conduct threat hunting for signs of exploitation; review access logs for suspicious activity targeting failure.aspx.

Mailenable CVE-2025-44148

EUVD-2025-16734 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2025-06-03 cve@mitre.org

RCE XSS Mailenable

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16734

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

PoC Detected

Jun 09, 2025 - 18:04 vuln.today

Public exploit code

CVE Published

Jun 03, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component

AnalysisAI

XSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.

Technical ContextAI

CWE-79.

RemediationAI

Update.

More in Mailenable

View all

CVE-2012-0389 MEDIUM This Month POC

4.3 Jan 24

Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4

CVE-2019-12924 CRITICAL Act Now

9.8 Jul 08

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploite

CVE-2026-32852 MEDIUM This Month POC

5.1 Mar 23

MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface

CVE-2026-32851 MEDIUM This Month POC

5.1 Mar 23

MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface

CVE-2026-32850 MEDIUM This Month POC

5.1 Mar 23

MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface

CVE-2019-12926 HIGH This Week

8.8 Jul 08

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. Rated high sever

CVE-2012-2588 MEDIUM This Month POC

4.3 Sep 19

Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitr

CVE-2019-12925 HIGH This Week

8.1 Jul 08

MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated user

CVE-2019-12923 MEDIUM This Month

6.5 Jul 08

In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not imp

CVE-2019-12927 MEDIUM This Month

6.1 Jul 08

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Rated med

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

CVE-2015-0072 MEDIUM POC

4.3

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

CVE-2025-44148 vulnerability details – vuln.today

Back

Mailenable CVE-2025-44148

Severity by source

CVSS VectorVendor: mitre

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mailenable

Same weakness CWE-79 – Cross-site Scripting (XSS)

Same technique RCE

Share

External POC / Exploit Code