CVE-2018-25269

CVE-2018-25269 is a cross-site scripting (XSS) vulnerability affecting ICEWARP version 11.0.0.0 that enables attackers to inject malicious HTML elements into emails using base64-encoded payloads embedded in object and embed tags. The vulnerability allows threat actors to craft emails containing data URIs with embedded scripts that execute in the client's email viewer, potentially compromising user sessions and exfiltrating sensitive information. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium severity) with a network-based attack vector requiring low complexity and user interaction to trigger. No special privileges are required for exploitation, and the impact includes both confidentiality and integrity compromise, though with limited scope. The EPSS probability score of 0.00029 indicates minimal real-world exploitation activity relative to other known vulnerabilities. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The FAUCET Risk Score of 43.0/100 and inactive Hot List status suggest limited community attention and exploit code availability. Organizations running ICEWARP 11.0.0.0 should apply vendor patches when available, but this does not appear to be an immediate critical threat based on current exploitation metrics.