Vulnerability Description
Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the log file name parameter in the Local Services Log page, (2) certificate file content in the SSL Certificates View Usage feature, and (3) the Certificate File name parameter in the WebMail Listeners SSL settings. Attackers can inject malicious JavaScript payloads that execute in administrators' browsers when they access affected pages or features, enabling privilege escalation attacks where low-privileged admins can force high-privileged admins to perform unauthorized actions.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Axigen | Axigen Mail Server | >= 10.3.0, < 10.5.57 |
Related Weaknesses (CWE)
References
- https://www.axigen.com/knowledgebase/Axigen-WebAdmin-Stored-XSS-Vulnerabilities-Vendor Advisory
- https://www.axigen.com/mail-server/download/Product
- https://github.com/osmancanvural/CVE-2025-68723
FAQ
What is CVE-2025-68723?
CVE-2025-68723 is a vulnerability with a CVSS score of 9.0 (CRITICAL). Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the log file name parameter in the Local Ser...
How severe is CVE-2025-68723?
CVE-2025-68723 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-68723?
Check the references section above for vendor advisories and patch information. Affected products include: Axigen Axigen Mail Server.