Webcit

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:citadel:webcit:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorCitadel (d963e00e-abff-5a8d-ac58-d202001f0bd4)
ProductWebcit (4f1d8a35-4342-5246-aae4-5cdc7572ccfd)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/mingodad/citadel purl2cpe 2026-06-01 10:14:43.195258

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-37845 vulnerable 2026-06-08 05:32:55.225205 Details available
An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only valid in non-authenticated state." in RFC2595). This potentially allows an attacker to cause a victim's e-mail messages to be stored into an attacker's IMAP mailbox, but depends on details of the victim's client behavior.
Published: 2023-05-29T00:00:00.000Z
Updated: 2025-01-14T17:46:34.428Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-29547 vulnerable 2026-06-08 05:24:58.360258 Details available
An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user session. This can lead to credential disclosure.
Published: 2023-05-29T00:00:00.000Z
Updated: 2025-01-14T17:52:53.266Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-27742 vulnerable 2026-06-08 05:23:53.095447 Details available
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Published: 2020-10-28T18:44:36.000Z
Updated: 2024-08-04T16:18:45.690Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-27741 vulnerable 2026-06-08 05:23:53.094907 Details available
Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Published: 2020-10-28T18:44:34.000Z
Updated: 2024-08-04T16:18:45.658Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-27740 vulnerable 2026-06-08 05:23:53.094450 Details available
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Published: 2020-10-28T18:44:30.000Z
Updated: 2024-08-04T16:18:45.675Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-27739 vulnerable 2026-06-08 05:23:53.094008 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-0364 vulnerable 2026-06-08 04:51:09.110916 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2007-3822 vulnerable 2026-06-08 04:49:55.111801 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2007-3821 vulnerable 2026-06-08 04:49:55.111101 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.