SM
Product
Smartermail
On CISA KEVExploited in the wildRansomware-linked
30
CVEs
3
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 6High 5Medium 11Low 0
Watch
Add Smartermail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-52691 RansomwareIn wildKEV | 10.0 | Dec 29 | Upload Arbitrary Files Affected: SmarterMail versions Build 9406 and earlier |
| CVE-2026-24423 RansomwareIn wildKEV | 9.8 | Jan 23 | SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API Affected: before 100.0.9511 |
| CVE-2026-23760 RansomwareIn wildKEV | 9.8 | Jan 22 | SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API Affected: before 100.0.9511 |
| CVE-2021-32234 | 9.8 | Nov 17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution Affected: 16.0.6345 before 100.0.7803 |
| CVE-2019-7214 | 9.8 | Apr 24 | SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data Affected: 16.0.6345 before 16.3.6985 |
| CVE-2026-40514 | 9.1 | Apr 27 | SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG Affected: before 100.0.9610 |
| CVE-2026-104084 | 8.8 | Oct 9 | SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token Affected: before Build 9777 |
| CVE-2026-7807 | 8.8 | May 8 | SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API Affected: before 100.0.9560 |
| CVE-2019-7212 | 8.2 | Apr 24 | SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys Affected: 16.0.6345 before 16.3.6985 |
| CVE-2020-29548 | 8.1 | Aug 17 | An issue was discovered in SmarterTools SmarterMail through 100.0.7537 Affected: through 100.0.7537 |
| CVE-2026-104082 | 7.2 | Oct 9 | SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount Affected: before Build 9777 |
| CVE-2019-7213 | 6.5 | Apr 24 | SmarterTools SmarterMail 16.x before build 6985 allows directory traversal Affected: 16.0.6345 before 16.3.6985 |
| CVE-2026-104083 | 6.1 | Oct 9 | SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content Affected: before Build 9777 |
| CVE-2021-43977 | 6.1 | Nov 17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS Affected: 16.0.6345 before 100.0.7803 |
| CVE-2021-32233 | 6.1 | Jul 6 | SmarterTools SmarterMail before Build 7776 allows XSS Affected: before 16.3.7776 |
| CVE-2019-7211 | 6.1 | Apr 24 | SmarterTools SmarterMail 16.x before build 6995 has stored XSS Affected: 16.0.6345 before 16.3.6955 |
| CVE-2015-9276 | 6.1 | Jan 16 | SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms Affected: before 13.3.5535 |
| CVE-2023-48116 | 5.4 | Dec 21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment Affected: 16.0.8495 before 16.0.8747 |
| CVE-2023-48115 | 5.4 | Dec 21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the… Affected: 16.0.8495 before 16.0.8747 |
| CVE-2023-48114 | 5.4 | Dec 21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document Affected: 16.0.8495 before 16.0.8747 |
| CVE-2021-40377 | 5.4 | Sep 8 | SmarterTools SmarterMail 16.x before build 7866 has stored XSS Affected: 16.0.6345 before 16.3.7866 |
| CVE-2026-25067 | 5.3 | Jan 29 | SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint Affected: before 100.0.9518 |
| CVE-2012-2578 | – | Sep 19 | Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a… Affected: 9.2 |
| CVE-2010-3486 | – | Sep 22 | Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded… Affected: 7.1.3876 |
| CVE-2008-1854 | – | Apr 16 | Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long… Affected: 5.0.2999 |
| CVE-2004-2585 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via… Affected: 1.6.1511; 1.6.1529 |
| CVE-2004-2587 | – | Dec 31 | login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly due to a buffer… Affected: 1.6.1511; 1.6.1529 |
| CVE-2004-2586 | – | Dec 31 | Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename… Affected: 1.6.1511; 1.6.1529 |
| CVE-2004-2584 | – | Dec 31 | frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name… Affected: 1.6.1511; 1.6.1529 |
| CVE-2004-2583 | – | Dec 31 | SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open… Affected: 1.6.1511; 1.6.1529 |
Showing 30