Vulnerability Description
An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2025-12460?
CVE-2025-12460 is a documented vulnerability. An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a re...
How severe is CVE-2025-12460?
CVSS scoring is not yet available for CVE-2025-12460. Check NVD for updates.
Is there a patch for CVE-2025-12460?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.