CVE-2025-63499

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
mitreCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
sogo
bullseye
vulnerable
bullseye (security)
vulnerable
bookworm
vulnerable
trixie
vulnerable
forky
vulnerable
sid
vulnerable
References
https://email.victim.com/SOGo/so/victim@victim.com/Mail/view?theme=%27%3CScRiPt%20%3Ealert%289998%29%3C%2FScRiPt%3E
https://github.com/poblaguev-tot/CVE-2025-63499