AL
Vendor
Alinto
20
CVEs
0
On KEV
0
New 30D
Products
SO8.8
SOGo
Alinto
18 CVEs0 on KEV0 new
SW6.1
Sogo Web Mail
Alinto
1 CVEs0 on KEV0 new
SW8.1
SOGo Webmail
Alinto
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-93453 | SO SOGo Alinto | 8.3 | Sep 17 | SOGo before 5.12.11 Password Reset Token Interception via Origin Header |
| CVE-2026-8851 | SW SOGo Webmail Alinto | 8.1 | May 18 | SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint |
| CVE-2026-46446 | SO SOGo Alinto | 7.1 | May 14 | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection |
| CVE-2026-46445 | SO SOGo Alinto | 7.1 | May 14 | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection |
| CVE-2026-33550 | SO SOGo Alinto | 2.6 | Mar 22 | SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended) |
| CVE-2025-71276 | SO SOGo Alinto | 6.1 | Mar 22 | SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories |
| CVE-2026-3054 | SO SOGo Alinto | 6.1 | Feb 24 | Alinto SOGo cross site scripting |
| CVE-2025-63499 | SO Sogo Alinto | 6.1 | Dec 4 | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter |
| CVE-2025-63498 | SO Sogo Alinto | 6.1 | Nov 24 | alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter |
| CVE-2024-24510 | SO Sogo Alinto | 6.1 | Sep 9 | Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component |
| CVE-2024-34462 | SO Sogo Alinto | 6.1 | May 4 | Alinto SOGo through 5.10.0 allows XSS during attachment preview |
| CVE-2023-48104 | SO Sogo Alinto | 6.1 | Jan 16 | Alinto SOGo before 5.9.1 is vulnerable to HTML Injection |
| CVE-2020-22402 | SW Sogo Web Mail Alinto | 6.1 | Jun 14 | Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code |
| CVE-2022-4558 | SO Sogo Alinto | 6.1 | Dec 16 | A vulnerability was found in Alinto SOGo up to 5.7.1 |
| CVE-2022-4556 | SO Sogo Alinto | 6.1 | Dec 16 | A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic |
| CVE-2015-5395 | SO Sogo Alinto | 8.8 | Sep 20 | Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0 |
| CVE-2016-6191 | SO Sogo Alinto | 6.1 | Feb 17 | Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or… |
| CVE-2016-6189 | SO Sogo Alinto | 4.3 | Feb 17 | Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML… |
| CVE-2014-9905 | SO Sogo Alinto | 6.1 | Feb 17 | Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an… |
| CVE-2016-6188 | SO Sogo Alinto | 6.5 | Feb 3 | Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to… |