CVE-2025-12460

An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.

• CWE-79

• https://auroramail.wordpress.com/2025/10/28/xss-vulnerability-in-afterlogic-webmail-and-aurora-corporate/

Published

Oct 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12453Improper neutralization of input during web page generation …6.1
• CVE-2025-12454Improper neutralization of input during web page generation …6.1
• CVE-2025-12455Observable response discrepancy vulnerability in OpenText™ V…7.5
• CVE-2025-12456The Centangle-Team plugin for WordPress is vulnerable to Cro…6.1
• CVE-2025-12457The Enable SVG, WebP, and ICO Upload plugin for WordPress is…6.4
• CVE-2025-1246Improper Restriction of Operations within the Bounds of a Me…7.8
• CVE-2025-12461This vulnerability allows an attacker to access parts of the…6.9
• CVE-2025-12462A Blind SQL injection vulnerability has been identified in D…9.3
• CVE-2025-12463An unauthenticated SQL Injection was discovered within the G…9.8
• CVE-2025-12464A stack-based buffer overflow was found in the QEMU e1000 ne…6.2
• CVE-2025-12465A Blind SQL injection vulnerability has been identified in Q…8.6
• CVE-2025-12466Authentication Bypass Using an Alternate Path or Channel vul…7.5