CVE-2007-0651: Mailenable Professional

Medium severity, CVSS 4.3. EPSS: 3.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via (1) e-mail messages and (2) the ID parameter to (a) right.asp, (b) Forms/MAI/list.asp, and (c) Forms/VCF/list.asp in mewebmail/base/default/lang/EN/.

Affected products

• Mailenable Mailenable Professional: version 1.0.004 only; version 1.0.005 only; version 1.0.006 only; version 1.0.007 only; version 1.0.008 only; version 1.0.009 only; …

Published 2007-02-15. Last modified 2026-06-16.