Netwin maintains a focused portfolio of email and messaging server products—including SurgeMail, SurgeFTP, DMail, CWMail, and DMail Web—that are moderately represented in the vulnerability landscape despite their narrow product scope. The vendor's disclosures cluster around application-layer weaknesses characteristic of web-facing and email-handling software: improper memory-buffer restrictions, cross-site scripting issues in web interfaces, and format-string vulnerabilities, reflecting the parsing and input-handling demands of email protocol implementations and web frontends. The vulnerability profile shows a tendency toward public exploit-code availability, indicating that disclosed flaws attract tooling interest despite the vendor's modest product footprint. Defenders should monitor Netwin's advisories for its mail-server deployments and apply updates promptly where these products are internet-reachable; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Netwin over time
Signals from CVEs in this vendor scope (51 CVEs).
51 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-10028HIGH Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via cra | Aug 5, 2025 | 8.6 | 43 | NO | YES |
CVE-2000-0490HIGH Buffer overflow in the NetWin DSMTP 2.7q in the NetWin dmail package allows remote attackers to execute arbitrary commands via a long ETRN request. | Jun 1, 2000 | 10.0 | 37 | NO | YES |
CVE-2008-1498HIGH Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitrary code via a long first argument to the | Mar 25, 2008 | 9.0 | 35 | NO | YES |
CVE-2008-7182MEDIUM Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote authenticated users to cause a denial of service (crash) and p | Sep 8, 2009 | 4.0 | 32 | NO | YES |
CVE-2008-1052MEDIUM The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length | Feb 27, 2008 | 6.4 | 31 | NO | YES |
CVE-2008-1054MEDIUM Stack-based buffer overflow in the _lib_spawn_user_getpid function in (1) swatch.exe and (2) surgemail.exe in NetWin SurgeMail 38k4 and earlier, and beta 39a, allows remote attacke | Feb 27, 2008 | 6.4 | 31 | NO | YES |
CVE-2008-1055HIGH Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (da | Feb 27, 2008 | 7.5 | 31 | NO | YES |
CVE-2004-2254HIGH SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration interface via a direct request to admin. | Dec 31, 2004 | 7.5 | 31 | NO | YES |
CVE-2001-0697MEDIUM NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service (crash) via an 'ls ..' command. | Sep 20, 2001 | 5.0 | 30 | NO | YES |
CVE-2006-5100HIGH PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS (aka webnews) 1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the WN_BAS | Oct 3, 2006 | 7.5 | 29 | NO | YES |
Signals from CVEs in this vendor scope (51 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Netwin.
Media articles that mention a CVE ID that affects a product developed by Netwin — matched by CVE ID, not by vendor name.