PatchTheCVE: coremail xthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2020-29133: jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.htmhttps://patchthecve.com/cve/CVE-2020-29133.htmlhttps://patchthecve.com/cve/CVE-2020-29133.htmlWed, 17 Jun 2026 03:11:04 +0000MEDIUM 6.1: jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile parameter.CVE-2018-14503: Cross-site scripting (XSS) vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inhttps://patchthecve.com/cve/CVE-2018-14503.htmlhttps://patchthecve.com/cve/CVE-2018-14503.htmlWed, 17 Jun 2026 01:41:07 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.CVE-2018-9330: register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under regishttps://patchthecve.com/cve/CVE-2018-9330.htmlhttps://patchthecve.com/cve/CVE-2018-9330.htmlWed, 17 Jun 2026 02:06:24 +0000MEDIUM 5.4: register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942.CVE-2015-6942: Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web scrhttps://patchthecve.com/cve/CVE-2015-6942.htmlhttps://patchthecve.com/cve/CVE-2015-6942.htmlWed, 17 Jun 2026 00:31:39 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.