Alinto vulnerabilities
Published CVEs affecting Alinto products: 8 record(s), with severity, exploitation and fixes.
CVE-2026-8851
High · 8.1
CWE-89 May 18, 2026
SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
CVE-2026-46446
High · 7.1
CWE-89 May 14, 2026
SQL Injection in Alinto Sogo
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
CVE-2026-46445
High · 7.1
CWE-89 May 14, 2026
SQL Injection in Alinto Sogo
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-33550
Low · 2.6
CWE-308 Mar 22, 2026
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too…
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
CVE-2025-71276
Medium · 6.1
CWE-79 Mar 22, 2026
Cross-site Scripting (XSS) in Alinto Sogo
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVE-2026-3054
Medium · 6.1
CWE-79 Feb 24, 2026
Alinto SOGo cross site scripting
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-63499
Medium · 6.1
CWE-79 Dec 4, 2025
Cross-site Scripting (XSS) in Alinto Sogo
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVE-2025-63498
Medium · 6.1
CWE-79 Nov 24, 2025
Cross-site Scripting (XSS) in Alinto Sogo
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.