Approved changes feed: RSS · Atom
cpe:2.3:a:modoboa:modoboa:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Modoboa (bcba66c1-50c4-56be-8bf4-bd089a254484) |
|---|---|
| Product | Modoboa (767d0593-b02a-5c14-af06-db265fde37c5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/modoboa/modoboa |
purl2cpe | 2026-06-01 10:11:19.457429 |
pkg:pypi/modoboa |
purl2cpe | 2026-06-01 10:11:19.457431 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-56780 |
vulnerable | 2026-07-29 01:00:29.301143 |
Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API
HIGH (7.5)
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.
Published: 2026-06-29T17:14:27.634Z
Updated: 2026-07-01T14:06:36.307Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27602 |
vulnerable | 2026-06-08 07:53:22.554347 |
Modoboa has an OS Command Injection
HIGH (7.2)
Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.
Published: 2026-03-25T18:49:25.825Z
Updated: 2026-03-26T15:38:37.459Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5690 |
vulnerable | 2026-06-08 06:19:44.498059 |
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
MEDIUM (5.3)
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
Published: 2023-10-20T16:22:53.540Z
Updated: 2024-09-11T18:32:26.708Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5689 |
vulnerable | 2026-06-08 06:19:44.497659 |
Cross-site Scripting (XSS) - DOM in modoboa/modoboa
HIGH (7.1)
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
Published: 2023-10-20T16:22:49.430Z
Updated: 2024-09-11T18:33:08.457Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5688 |
vulnerable | 2026-06-08 06:19:44.497011 |
Cross-site Scripting (XSS) - DOM in modoboa/modoboa
CRITICAL (9.8)
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
Published: 2023-10-20T16:22:46.873Z
Updated: 2024-09-11T18:34:05.877Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2228 |
vulnerable | 2026-06-08 06:02:41.649114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2227 |
vulnerable | 2026-06-08 06:02:41.648626 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2160 |
vulnerable | 2026-06-08 06:02:41.520523 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0777 |
vulnerable | 2026-06-08 05:52:32.608781 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0438 |
vulnerable | 2026-06-08 05:52:04.954697 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.