modoboa records

16 published records for vendor modoboa.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
49Plan	CVE-2023-2227Proof of concept	Improper Authorization in modoboa/modoboamodoboa · modoboa · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.1	—	44.0%	Apr 21, 2023
44Plan	CVE-2023-0777Proof of concept	Authentication Bypass by Primary Weakness in modoboa/modoboamodoboa · modoboa · CWE-305 Pre-auth Auth bypass	Critical9.8	—	15.2%	Feb 10, 2023
39Monitor	CVE-2023-2160No exploit	Weak Password Requirements in modoboa/modoboamodoboa · modoboa · CWE-521 Pre-auth	Critical9.8	—	0.6%	Apr 18, 2023
35Monitor	CVE-2023-5690No exploit	Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa · modoboa · CWE-352 Pre-auth CSRF	High8.8	—	0.4%	Oct 20, 2023
30Monitor	CVE-2019-19702No exploit	The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.modoboa · modoboa-dmarc · CWE-611 Pre-auth XXE Denial of service	High7.5	—	1.5%	Dec 10, 2019
30Monitor	CVE-2023-0860Proof of concept	Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installermodoboa · installer · CWE-307 Pre-auth Denial of service	High7.5	—	0.7%	Feb 16, 2023
28Monitor	CVE-2026-27602No exploit	Modoboa has an OS Command Injectionmodoboa · modoboa · CWE-78 RCE Command injection	High7.2	—	0.7%	Mar 25, 2026
27Monitor	CVE-2023-2228No exploit	Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa · modoboa · CWE-352 CSRF	Medium6.8	—	0.4%	Apr 21, 2023
26Monitor	CVE-2023-0398No exploit	Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa · modoboa · CWE-352 Pre-auth CSRF	Medium6.5	—	0.3%	Jan 19, 2023
26Monitor	CVE-2023-0438No exploit	Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa · modoboa · CWE-352 Pre-auth CSRF	Medium6.5	—	0.3%	Jan 23, 2023
21Monitor	CVE-2023-0470No exploit	Cross-site Scripting (XSS) - Stored in modoboa/modoboamodoboa · modoboa · CWE-79 XSS	Medium5.4	—	0.6%	Jan 26, 2023
21Monitor	CVE-2023-5688No exploit	Cross-site Scripting (XSS) - DOM in modoboa/modoboamodoboa · modoboa · CWE-79 XSS	Medium5.4	—	0.6%	Oct 20, 2023
21Monitor	CVE-2023-5689No exploit	Cross-site Scripting (XSS) - DOM in modoboa/modoboamodoboa · modoboa · CWE-79 XSS	Medium5.4	—	0.5%	Oct 20, 2023
21Monitor	CVE-2023-0519No exploit	Cross-site Scripting (XSS) - Stored in modoboa/modoboamodoboa · modoboa · CWE-79 XSS	Medium5.4	—	0.5%	Jan 26, 2023
19Monitor	CVE-2023-0949No exploit	Cross-site Scripting (XSS) - Reflected in modoboa/modoboamodoboa · modoboa · CWE-79 XSS	Medium4.8	—	0.5%	Feb 22, 2023
17Monitor	CVE-2023-0406No exploit	Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa · modoboa · CWE-352 Pre-auth CSRF	Medium4.3	—	0.4%	Jan 19, 2023

CVE-2023-2227
49Plan
Improper Authorization in modoboa/modoboa
CriticalCVSS 9.1Proof of conceptEPSS 44%
- Pre-auth
- Broken access control (IDOR)
modoboa · modoboaApr 21, 2023
CVE-2023-0777
44Plan
Authentication Bypass by Primary Weakness in modoboa/modoboa
CriticalCVSS 9.8Proof of conceptEPSS 15%
- Pre-auth
- Auth bypass
modoboa · modoboaFeb 10, 2023
CVE-2023-2160
39Monitor
Weak Password Requirements in modoboa/modoboa
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
modoboa · modoboaApr 18, 2023
CVE-2023-5690
35Monitor
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
modoboa · modoboaOct 20, 2023
CVE-2019-19702
30Monitor
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
HighCVSS 7.5No exploitEPSS 1%
modoboa · modoboa-dmarcDec 10, 2019
CVE-2023-0860
30Monitor
Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Denial of service
modoboa · installerFeb 16, 2023
CVE-2026-27602
28Monitor
Modoboa has an OS Command Injection
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
modoboa · modoboaMar 25, 2026
CVE-2023-2228
27Monitor
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
MediumCVSS 6.8No exploitEPSS 0%
- CSRF
modoboa · modoboaApr 21, 2023
CVE-2023-0398
26Monitor
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
modoboa · modoboaJan 19, 2023
CVE-2023-0438
26Monitor
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
modoboa · modoboaJan 23, 2023
CVE-2023-0470
21Monitor
Cross-site Scripting (XSS) - Stored in modoboa/modoboa
MediumCVSS 5.4No exploitEPSS 1%
- XSS
modoboa · modoboaJan 26, 2023
CVE-2023-5688
21Monitor
Cross-site Scripting (XSS) - DOM in modoboa/modoboa
MediumCVSS 5.4No exploitEPSS 1%
- XSS
modoboa · modoboaOct 20, 2023
CVE-2023-5689
21Monitor
Cross-site Scripting (XSS) - DOM in modoboa/modoboa
MediumCVSS 5.4No exploitEPSS 1%
- XSS
modoboa · modoboaOct 20, 2023
CVE-2023-0519
21Monitor
Cross-site Scripting (XSS) - Stored in modoboa/modoboa
MediumCVSS 5.4No exploitEPSS 1%
- XSS
modoboa · modoboaJan 26, 2023
CVE-2023-0949
19Monitor
Cross-site Scripting (XSS) - Reflected in modoboa/modoboa
MediumCVSS 4.8No exploitEPSS 0%
- XSS
modoboa · modoboaFeb 22, 2023
CVE-2023-0406
17Monitor
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
modoboa · modoboaJan 19, 2023