Skip to content

Smartertools Smartermail vulnerabilities

smartertools smartermailSmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh TokenCVE-2026-1040848.7 HighOctober 9, 2026
smartertools smartermailSmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign ContentCVE-2026-1040835.3 MediumOctober 9, 2026
smartertools smartermailSmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume MountCVE-2026-104082Public exploit8.6 HighOctober 9, 2026
smartertools smartermailSmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} APICVE-2026-78078.7 HighMay 8, 2026
smartertools smartermailSmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNGCVE-2026-405148.2 HighApril 27, 2026
smartertools smartermailSmarterTools SmarterMail before 9526 allows XSS via MAPI requests.CVE-2026-269307.2 HighFebruary 16, 2026
smartertools smartermailSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionCVE-2026-250676.9 MediumJanuary 29, 2026
smartertools smartermailSmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APICVE-2026-24423In KEVPublic exploitEPSS 88.2%9.3 CriticalJanuary 23, 2026
smartertools smartermailSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APICVE-2026-23760In KEVPublic exploitEPSS 96.4%9.3 CriticalJanuary 22, 2026
smartertools smartermailUpload Arbitrary FilesCVE-2025-52691In KEVPublic exploitEPSS 85.7%10.0 CriticalDecember 29, 2025
smartertools smartermailSmarterTools SmarterMail 16.x 8495 through 8664 before 8747 allows stored XSS via a crafted...CVE-2023-481165.4 MediumDecember 21, 2023
smartertools smartermailSmarterTools SmarterMail 16.x 8495 through 8664 before 8747 allows stored DOM XSS because an XSS...CVE-2023-481155.4 MediumDecember 21, 2023
smartertools smartermailSmarterTools SmarterMail 16.x 8495 through 8664 before 8747 allows stored XSS by using image/svg...CVE-2023-481145.4 MediumDecember 21, 2023
smartertools smartermailSmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.CVE-2021-439776.1 MediumNovember 17, 2021
smartertools smartermailSmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.CVE-2021-322349.8 CriticalNovember 17, 2021
smartertools smartermailSmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize...CVE-2021-403775.4 MediumSeptember 8, 2021
smartertools smartermailAn issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle...CVE-2020-295488.1 HighAugust 17, 2021
smartertools smartermailSmarterTools SmarterMail before Build 7776 allows XSS.CVE-2021-322336.1 MediumJuly 5, 2021
smartertools smartermailSmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user...CVE-2019-7213Public exploitEPSS 41.5%6.5 MediumApril 24, 2019
smartertools smartermailSmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated...CVE-2019-72128.2 HighApril 24, 2019
smartertools smartermailSmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed...CVE-2019-72116.1 MediumApril 24, 2019
smartertools smartermailSmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An...CVE-2019-7214Public exploitEPSS 84.9%9.8 CriticalApril 24, 2019
smartertools smartermailSmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS...CVE-2015-92766.1 MediumJanuary 16, 2019
smartertools smartermailMultiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to...CVE-2012-2578Public exploit4.3 MediumSeptember 19, 2012
smartertools smartermailDirectory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote...CVE-2010-3486Public exploit5.0 MediumSeptember 22, 2010
smartertools smartermailUnspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows...CVE-2008-1854Public exploit5.0 MediumApril 16, 2008
smartertools smartermail enterpriseCross-site scripting (XSS) vulnerability in SmarterTools SmarterMail Enterprise 4.3 allows remote...CVE-2008-0872Public exploit4.3 MediumFebruary 21, 2008
smartertools smartermaillogin.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a...CVE-2004-25875.0 MediumDecember 31, 2004
smartertools smartermailDirectory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511...CVE-2004-25865.0 MediumDecember 31, 2004
smartertools smartermailCross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511...CVE-2004-25854.3 MediumDecember 31, 2004
smartertools smartermailfrmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated...CVE-2004-25844.0 MediumDecember 31, 2004
smartertools smartermailSMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a...CVE-2004-25837.8 HighDecember 31, 2004