CVE-2007-5290: Afterlogic Mailbee Webmail

Medium severity, CVSS 4.3. EPSS: 3.8% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.

Affected products

• Afterlogic Mailbee Webmail: any version; version 3.1 only; version 3.2 only; version 3.3 only; version 3.4 only

Published 2007-10-09. Last modified 2026-06-16.