CVE-2023-39699

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.

• CWE-22

• https://cwe.mitre.org/data/definitions/98.htmlThird Party Advisory
• https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OUExploit, Third Party Advisory
• https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_InclusionThird Party Advisory
• https://cwe.mitre.org/data/definitions/98.htmlThird Party Advisory
• https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OUExploit, Third Party Advisory
• https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_InclusionThird Party Advisory

Published

Aug 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39681Cuppa CMS v1.0 was discovered to contain a remote code execu…9.8
• CVE-2023-39683Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12…6.1
• CVE-2023-39685An issue in hjson-java up to v3.0.0 allows attackers to caus…7.5
• CVE-2023-3969A vulnerability, which was classified as problematic, has be…5.4
• CVE-2023-39691An issue discovered in kodbox through 1.43 allows attackers …9.8
• CVE-2023-39695Insufficient session expiration in Elenos ETG150 FM Transmit…5.3
• CVE-2023-3970A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2023-39700IceWarp Mail Server v10.4.5 was discovered to contain a refl…6.1
• CVE-2023-39703A cross site scripting (XSS) vulnerability in the Markdown E…6.1
• CVE-2023-39707A stored cross-site scripting (XSS) vulnerability in Free an…5.4
• CVE-2023-39708A stored cross-site scripting (XSS) vulnerability in Free an…6.1
• CVE-2023-39709Multiple cross-site scripting (XSS) vulnerabilities in Free …6.1