https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-68723.htmlhttps://patchthecve.com/cve/CVE-2025-68723.htmlWed, 17 Jun 2026 09:59:28 +0000CRITICAL 9.0: Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the log file name parameter in the Local Services Log page, (2) certificate file content in the SSL Certificates View Usage feature, and (3) thehttps://patchthecve.com/cve/CVE-2025-68643.htmlhttps://patchthecve.com/cve/CVE-2025-68643.htmlWed, 17 Jun 2026 09:59:22 +0000MEDIUM 5.4: Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploit this by deploying a multi-stage attack. In the first stage, a malicious JavaScript payload is injected into the timeFormat preference by exhttps://patchthecve.com/cve/CVE-2025-68722.htmlhttps://patchthecve.com/cve/CVE-2025-68722.htmlWed, 17 Jun 2026 09:59:28 +0000HIGH 8.8: Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improper handling of the _s (breadcrumb) parameter. The application accepts state-changing requests via the GET method and automatically processes https://patchthecve.com/cve/CVE-2025-68721.htmlhttps://patchthecve.com/cve/CVE-2025-68721.htmlWed, 17 Jun 2026 09:59:28 +0000HIGH 8.1: Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the at