Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-11182

CVE-2024-11182MEDIUM

MDaemon Email Server — Stored XSS vulnerability in MDaemon Email Server

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   L   N    5.3   .1759   97.1   YES

AFFECTED
  Product       Versions     Fixed
  Email Server  unspecified  24.5.1

TIMELINE
  Nov 13  Reserved by ESET
  Nov 15  Published (CNA: ESET)
  May 19  Added to CISA KEV, remediation due 2025-06-09

CWE-79 · CNA: ESET · CVSS v4.0 · 2 references · KEV due June 9, 2025

Description

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
November 13, 2024	Reserved	Reserved by ESET
November 15, 2024	Published	Published (CNA: ESET)
May 19, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-06-09

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
MDaemon	Email Server	—	—	24.5.1

Weaknesses

CWE-79

References (2)

Authoritative record: CVE-2024-11182 at cve.org

Vendors: mdaemon

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-11182 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.