Postfixadmin
Monthly
Stored cross-site scripting in PostfixAdmin through 4.0.5 lets an authenticated mailbox user persist a script payload in the description field of a TOTP exception, which then executes in the browser of a global administrator who opens totp-exceptions.php and can issue authenticated admin requests using that page's CSRF token. The same output-escaping defect exists in the application-password list (app-passwords.php), which the vendor commit fixes alongside the TOTP list. Exploitation is bounded: it needs a legitimate low-privilege mailbox account, the TOTP feature in use, and an administrator actually viewing the affected list page; the upstream fix is public (PRs #1172 and #1186), no tagged patched release is confirmed in the supplied data, and no public exploit code or active exploitation was identified at time of analysis.
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 39.9%.
Stored cross-site scripting in PostfixAdmin through 4.0.5 lets an authenticated mailbox user persist a script payload in the description field of a TOTP exception, which then executes in the browser of a global administrator who opens totp-exceptions.php and can issue authenticated admin requests using that page's CSRF token. The same output-escaping defect exists in the application-password list (app-passwords.php), which the vendor commit fixes alongside the TOTP list. Exploitation is bounded: it needs a legitimate low-privilege mailbox account, the TOTP feature in use, and an administrator actually viewing the affected list page; the upstream fix is public (PRs #1172 and #1186), no tagged patched release is confirmed in the supplied data, and no public exploit code or active exploitation was identified at time of analysis.
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 39.9%.