CVE-2025-68643

Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploit this by deploying a multi-stage attack. In the first stage, a malicious JavaScript payload is injected into the timeFormat preference by exploiting a separate vulnerability or using compromised credentials. In the second stage, when the victim logs into the WebMail interface, the unsanitized timeFormat value is loaded from storage and inserted into the DOM, causing the injected script to execute.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.axigen.com/knowledgebase/Axigen-WebMail-Stored-XSS-Vulnerability-CVE-2025-68643-_405.html	Vendor Advisory
https://www.axigen.com/mail-server/download/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:axigen:axigen_mail_server::::::::
	cpe:2.3:a:axigen:axigen_mail_server::::::::

History

No history.

Information

Published : 2026-02-05 17:16

Updated : 2026-02-11 21:16

NVD link : CVE-2025-68643

Mitre link : CVE-2025-68643

CVE.ORG link : CVE-2025-68643

JSON object : View

Products Affected

axigen

axigen_mail_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-68643", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2026-02-05T17:16:12.597", "references": [{"url": "https://www.axigen.com/knowledgebase/Axigen-WebMail-Stored-XSS-Vulnerability-CVE-2025-68643-_405.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.axigen.com/mail-server/download/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploit this by deploying a multi-stage attack. In the first stage, a malicious JavaScript payload is injected into the timeFormat preference by exploiting a separate vulnerability or using compromised credentials. In the second stage, when the victim logs into the WebMail interface, the unsanitized timeFormat value is loaded from storage and inserted into the DOM, causing the injected script to execute."}, {"lang": "es", "value": "Axigen Mail Server anterior a 10.5.57 permite cross-site scripting (XSS) almacenado en el manejo del par\u00e1metro de preferencia de cuenta timeFormat. Los atacantes pueden explotar esto mediante el despliegue de un ataque de m\u00faltiples etapas. En la primera etapa, se inyecta una carga \u00fatil de JavaScript maliciosa en la preferencia timeFormat explotando una vulnerabilidad separada o utilizando credenciales comprometidas. En la segunda etapa, cuando la v\u00edctima inicia sesi\u00f3n en la interfaz de WebMail, el valor timeFormat no saneado se carga del almacenamiento y se inserta en el DOM, lo que provoca la ejecuci\u00f3n del script inyectado."}], "lastModified": "2026-02-11T21:16:17.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FD23438-2B7F-48CB-9300-2A47F2B96A01", "versionEndExcluding": "10.5.57", "versionStartIncluding": "10.3.0"}, {"criteria": "cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FE47CA3-597B-45EE-BCFA-60440CDB5ECB", "versionEndExcluding": "10.6.26", "versionStartIncluding": "10.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}