https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-37238.htmlhttps://patchthecve.com/cve/CVE-2022-37238.htmlWed, 17 Jun 2026 04:54:46 +0000MEDIUM 5.4: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.https://patchthecve.com/cve/CVE-2022-37245.htmlhttps://patchthecve.com/cve/CVE-2022-37245.htmlWed, 17 Jun 2026 04:54:47 +0000MEDIUM 5.4: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.https://patchthecve.com/cve/CVE-2022-37244.htmlhttps://patchthecve.com/cve/CVE-2022-37244.htmlWed, 17 Jun 2026 04:54:47 +0000MEDIUM 5.4: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection.https://patchthecve.com/cve/CVE-2022-37243.htmlhttps://patchthecve.com/cve/CVE-2022-37243.htmlWed, 17 Jun 2026 04:54:47 +0000MEDIUM 5.4: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.https://patchthecve.com/cve/CVE-2022-37242.htmlhttps://patchthecve.com/cve/CVE-2022-37242.htmlWed, 17 Jun 2026 04:54:47 +0000CRITICAL 9.8: MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.https://patchthecve.com/cve/CVE-2022-37241.htmlhttps://patchthecve.com/cve/CVE-2022-37241.htmlWed, 17 Jun 2026 04:54:47 +0000MEDIUM 5.4: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.https://patchthecve.com/cve/CVE-2022-37240.htmlhttps://patchthecve.com/cve/CVE-2022-37240.htmlWed, 17 Jun 2026 04:54:47 +0000CRITICAL 9.8: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.https://patchthecve.com/cve/CVE-2022-37239.htmlhttps://patchthecve.com/cve/CVE-2022-37239.htmlWed, 17 Jun 2026 04:54:46 +0000MEDIUM 5.4: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.https://patchthecve.com/cve/CVE-2022-29976.htmlhttps://patchthecve.com/cve/CVE-2022-29976.htmlWed, 17 Jun 2026 04:41:04 +0000MEDIUM 5.4: An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .https://patchthecve.com/cve/CVE-2022-29975.htmlhttps://patchthecve.com/cve/CVE-2022-29975.htmlWed, 17 Jun 2026 04:41:04 +0000MEDIUM 5.4: An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .https://patchthecve.com/cve/CVE-2022-25356.htmlhttps://patchthecve.com/cve/CVE-2022-25356.htmlWed, 17 Jun 2026 04:33:26 +0000MEDIUM 5.3: Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection.https://patchthecve.com/cve/CVE-2021-27183.htmlhttps://patchthecve.com/cve/CVE-2021-27183.htmlWed, 17 Jun 2026 03:44:25 +0000HIGH 7.2: An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly leadhttps://patchthecve.com/cve/CVE-2021-27182.htmlhttps://patchthecve.com/cve/CVE-2021-27182.htmlWed, 17 Jun 2026 03:44:25 +0000HIGH 8.8: An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.https://patchthecve.com/cve/CVE-2021-27181.htmlhttps://patchthecve.com/cve/CVE-2021-27181.htmlWed, 17 Jun 2026 03:44:25 +0000HIGH 8.8: An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the vahttps://patchthecve.com/cve/CVE-2021-27180.htmlhttps://patchthecve.com/cve/CVE-2021-27180.htmlWed, 17 Jun 2026 03:44:24 +0000MEDIUM 6.1: An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.https://patchthecve.com/cve/CVE-2020-18724.htmlhttps://patchthecve.com/cve/CVE-2020-18724.htmlWed, 17 Jun 2026 02:59:26 +0000MEDIUM 5.4: Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.https://patchthecve.com/cve/CVE-2020-18723.htmlhttps://patchthecve.com/cve/CVE-2020-18723.htmlWed, 17 Jun 2026 02:59:26 +0000MEDIUM 5.4: Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.