Vulnerabilidades do Alinto Sogo
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Alinto Sogo: 7 registro(s), com versões afetadas e correções.cpe:2.3:a:alinto:sogo
CVE-2026-46446
Alta · 7.1
CWE-89 14/05/2026
SQL Injection em Alinto Sogo
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
CVE-2026-46445
Alta · 7.1
CWE-89 14/05/2026
SQL Injection em Alinto Sogo
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-33550
Baixa · 2.6
CWE-308 22/03/2026
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too…
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
CVE-2025-71276
Média · 6.1
CWE-79 22/03/2026
Cross-site Scripting (XSS) em Alinto Sogo
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVE-2026-3054
Média · 6.1
CWE-79 24/02/2026
Alinto SOGo cross site scripting
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-63499
Média · 6.1
CWE-79 04/12/2025
Cross-site Scripting (XSS) em Alinto Sogo
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVE-2025-63498
Média · 6.1
CWE-79 24/11/2025
Cross-site Scripting (XSS) em Alinto Sogo
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.