Live › vulnerability › CVE-2026-119761
Axigen Mail Server's WebMail does not escape sender display names in the conversation view. An attacker who sends an email with script in the From display name can run that script in the browser of the recipient when they open the folder, enabling mailbox content theft or redirection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Teams that run Axigen Mail Server with WebMail enabled and users who open mail through it. The flaw is in the WebMail conversation view, so deployments that do not expose WebMail are not reached by this route. The sources do not say whether any configuration other than WebMail being in use changes exposure.
No product ranges from the sources yet.
10.6.39 on the 10.6 line or 10.7.1 on the 10.7 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.
This page as .md · .json · in your agent: get_signal("CVE-2026-119761")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.