Vulnerabilidades de Alinto
CVEs publicadas que afetam produtos de Alinto: 8 registro(s), com severidade, exploração e correções.
CVE-2026-8851
Alta · 8.1
CWE-89 18/05/2026
SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
CVE-2026-46446
Alta · 7.1
CWE-89 14/05/2026
SQL Injection em Alinto Sogo
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
CVE-2026-46445
Alta · 7.1
CWE-89 14/05/2026
SQL Injection em Alinto Sogo
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-33550
Baixa · 2.6
CWE-308 22/03/2026
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too…
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
CVE-2025-71276
Média · 6.1
CWE-79 22/03/2026
Cross-site Scripting (XSS) em Alinto Sogo
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVE-2026-3054
Média · 6.1
CWE-79 24/02/2026
Alinto SOGo cross site scripting
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-63499
Média · 6.1
CWE-79 04/12/2025
Cross-site Scripting (XSS) em Alinto Sogo
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVE-2025-63498
Média · 6.1
CWE-79 24/11/2025
Cross-site Scripting (XSS) em Alinto Sogo
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.