CVE-2025-12460 describes a Cross-Site Scripting (XSS) vulnerability in Afterlogic Aurora webmail version 9.8.3 and earlier. An attacker can exploit this by sending a specially crafted HTML email containing JavaScript within an img tag. This allows for arbitrary JavaScript execution in the victim's browser, potentially leading to unauthorized access to user data. The vulnerability has a CVSS score of 5.3 (Medium), indicating a low attack complexity and requiring user interaction (opening the malicious email). The potential impact is limited to confidentiality and integrity of user data. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are also absent, suggesting low current attention to this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 9.8.3CPE match | cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.