CVE-2025-67823

A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction where the email channel is enabled. This could allow an attacker to execute arbitrary scripts in the victim's browser or desktop client application.

• CWE-79

• https://www.mitel.com/support/security-advisoriesVendor Advisory
• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0010Vendor Advisory

Published

Jan 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67811Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API …6.5
• CVE-2025-67813Quest KACE Desktop Authority through 11.3.1 has Insecure Per…5.3
• CVE-2025-67818An issue was discovered in Weaviate OSS before 1.33.4. An at…7.2
• CVE-2025-67819An issue was discovered in Weaviate OSS before 1.33.4. Due t…4.9
• CVE-2025-6782The GoZen Forms plugin for WordPress is vulnerable to SQL In…7.5
• CVE-2025-67822A vulnerability in the Provisioning Manager component of Mit…9.4
• CVE-2025-67824The WorklogPRO - Jira Timesheets plugin in the Jira Data Cen…6.1
• CVE-2025-67825An issue was discovered in Nitro PDF Pro for Windows before …5.5
• CVE-2025-67826An issue was discovered in K7 Ultimate Security 17.0.2045. A…7.7
• CVE-2025-67829Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirecti…9.8
• CVE-2025-6783The GoZen Forms plugin for WordPress is vulnerable to SQL In…7.5
• CVE-2025-67830Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL …9.8