Approved changes feed: RSS · Atom
cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Afterlogic (9dd7f5df-4ffb-51fb-89bf-599392077f38) |
|---|---|
| Product | Aurora (9fcc6e1e-0111-5686-a0e0-5ca5440dad4d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-12460 |
vulnerable | 2026-06-08 07:04:30.267611 |
Stored XSS vulnerability in Afterlogic Aurora webmail
An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
Published: 2025-10-31T13:53:58.574Z
Updated: 2025-10-31T14:09:59.967Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-26294 |
vulnerable | 2026-06-08 05:30:42.172181 |
Details available
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
Published: 2021-03-07T03:42:34.000Z
Updated: 2024-08-03T20:19:20.346Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-26293 |
vulnerable | 2026-06-08 05:30:42.170704 |
Details available
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
Published: 2021-03-04T20:32:44.000Z
Updated: 2024-08-03T20:19:20.256Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16238 |
vulnerable | 2026-06-08 05:13:07.944537 |
Details available
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.
Published: 2019-09-12T15:53:03.000Z
Updated: 2024-08-05T01:10:41.643Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.