Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2025-14499: IceWarp: Remote Attackers Can Bypass IceWarp Login
CVE-2025-14499 · published 10 months ago
Summary
An attacker can trick an IceWarp user into visiting a malicious website or opening a file, allowing the attacker to access the user's account without a password. This can lead to unauthorized access to sensitive information and actions. Update IceWarp to the latest version to prevent this vulnerability.
Original advisory text
IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is...
IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of a parameter passed to the gmaps webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25441.
The specific flaw exists within the handling of a parameter passed to the gmaps webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25441.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-14499 · NVD
Track software like this
Free during beta