MEDIUM 5.1 NVD
CVE-2026-121551
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exce
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.
References
- https://github.com/postfixadmin/postfixadmin
- https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#
- https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56
- https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa
- https://github.com/postfixadmin/postfixadmin/issues/1185
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.