Dashboard / CVE-2026-114552

CVE-2026-114552

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 63/100
Published: 2026-11-04 Modified: 2026-11-12 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the parseObjectResponse method. The issue results from the lack of proper restriction of XML External Entity (XXE) references. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29137.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
MailEnable MailEnable 10.59
MailEnable MailEnable 10.59

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.46%
Raw Score 0.004640
Percentile 40.7%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00464
2026-11-13
0.00464
2026-11-12
0.00464
2026-11-10
0.00464
2026-11-09
0.00464
2026-11-08
0.00464
2026-11-07
0.00464
2026-11-06
0.00464
2026-11-05
0.00464
2026-11-04
0.00464

Intelligence Sources

mitre ref →
nvd ref →

External Links