Alinto Sogo vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Alinto Sogo: 8 record(s), with affected versions and fixes.cpe:2.3:a:alinto:sogo
CVE-2026-93453
High · 8.3
CWE-640 Sep 17, 2026
SOGo before 5.12.11 Password Reset Token Interception via Origin Header
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
CVE-2026-46446
High · 7.1
CWE-89 May 14, 2026
SQL Injection in Alinto Sogo
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
CVE-2026-46445
High · 7.1
CWE-89 May 14, 2026
SQL Injection in Alinto Sogo
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-33550
Low · 2.6
CWE-308 Mar 22, 2026
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too…
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
CVE-2025-71276
Medium · 6.1
CWE-79 Mar 22, 2026
Cross-site Scripting (XSS) in Alinto Sogo
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVE-2026-3054
Medium · 6.1
CWE-79 Feb 24, 2026
Alinto SOGo cross site scripting
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-63499
Medium · 6.1
CWE-79 Dec 4, 2025
Cross-site Scripting (XSS) in Alinto Sogo
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVE-2025-63498
Medium · 6.1
CWE-79 Nov 24, 2025
Cross-site Scripting (XSS) in Alinto Sogo
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.