alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
References
| Link | Resource |
|---|---|
| https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c | Patch |
| https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 | Release Notes |
| https://github.com/xryptoh/CVE-2025-63498 | Exploit Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/11/msg00029.html | Mailing List |
Configurations
History
30 Dec 2025, 17:32
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Alinto
Debian Debian debian Linux Alinto sogo |
|
| CPE | cpe:2.3:a:alinto:sogo:5.12.3:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
| References | () https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c - Patch | |
| References | () https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 - Release Notes | |
| References | () https://github.com/xryptoh/CVE-2025-63498 - Exploit, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2025/11/msg00029.html - Mailing List |
28 Nov 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Nov 2025, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-24 21:16
Updated : 2025-12-30 17:32
NVD link : CVE-2025-63498
Mitre link : CVE-2025-63498
CVE.ORG link : CVE-2025-63498
JSON object : View
Products Affected
alinto
- sogo
debian
- debian_linux
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')