📦

mailenable

Vendor: mailenable

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 6 Code Available
Total RCEs 2 Remote Access
Total CVEs 84 Total Indexed
Avg. EPSS 1.71% Exploit Prob.
Latest CVE CVE-2026-44400 May 08

Security Vulnerability Index

Page 5 / 9
4.3 CVSS
CVE-2012-2588
Exploit Found

Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

EPSS: 0.35%
4.3 CVSS
CVE-2012-0389
Exploit Found

Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.

EPSS: 33.84%
5.0 CVSS
CVE-2010-2580

The SMTP service (MESMTPC.exe) in MailEnable 3.x and 4.25 does not properly perform a length check, which allows remote attackers to cause a denial of service (crash) via a long (1) email address in the MAIL FROM command, or (2) domain name in the RCPT TO command, which triggers an "unhandled invalid parameter error."

EPSS: 2.17%
5.0 CVSS
CVE-2008-3449

MailEnable Professional 3.5.2 and Enterprise 3.52 allow remote attackers to cause a denial of service (crash) via multiple IMAP connection requests to the same folder.

EPSS: 3.42%
7.8 CVSS
CVE-2007-0955
Exploit Found

The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service (application crash) via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port (143/tcp), which results in an out-of-bounds read.

EPSS: 14.59%
6.8 CVSS
CVE-2006-6291

Stack overflow in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authenticated users to cause a denial of service (crash) via a long argument containing * (asterisk) and ? (question mark) characters to the DELETE command, as addressed by the ME-10020 hotfix.

EPSS: 1.46%
7.5 CVSS
CVE-2006-1337
RCE

Buffer overflow in the POP 3 (POP3) service in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 allows remote attackers to execute arbitrary code via unknown vectors before authentication.

EPSS: 2.88%
4.3 CVSS
CVE-2004-2727
Exploit Found

Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.

EPSS: 4.40%
5.0 CVSS
CVE-2004-2726

HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackers to cause a denial of service (null dereference and application crash). NOTE: This is a different vulnerability than CVE-2005-1348.

EPSS: 2.38%
5.0 CVSS
CVE-2002-2357
Exploit Found

MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a buffer overflow.

EPSS: 3.35%