Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Alinto SOGo 5.12.3/5.12.4 allows hackers to inject malicious code
CVE-2026-3054
Summary
A security weakness in Alinto SOGo versions 5.12.3 and 5.12.4 makes it possible for an attacker to inject malicious code into a website, potentially allowing them to steal sensitive information or take control of user sessions. This is a concern because it can be exploited remotely, and an exploit is already publicly available. Alinto, the vendor, has not responded to the discovery of this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| alinto | sogo | 5.12.3 | – |
| alinto | sogo | 5.12.4 | – |
Original title
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remot...
Original description
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
5.0
nvd CVSS3.1
6.1
nvd CVSS4.0
5.3
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
CWE-94
Code Injection
- https://vuldb.com/?ctiid.347412 Permissions Required Third Party Advisory VDB Entry
- https://vuldb.com/?id.347412 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.757609 Third Party Advisory VDB Entry
Published: 24 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026