CVE-2025-52557CWE-1384

Mail-0 Zero Session Hijacking Via Email

High · published June 21, 2025

CVSS v4.0
8.6
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.7th percentile
Weakness
CWE-1384 · Improper Handling of Physical or Environmental Conditions
Published
2025-06-21T01:42Z
EPSS history
Timeline
  • 21 JUN 01:42Z
    Mail-0 Zero Session Hijacking Via Email
    cvelistv5