Skip to content
Noroxi

SmarterTools records

52 published records for vendor smartertools.

Researcher profile

Entered KEV
3 · 5.8%
Weaponized
4 · 7.7%
Pre-auth RCE
6
With a fix record
5.8%
Median publish → KEV
13 days

Records by year

  1. 17
  2. 19
  3. 21
  4. 22
  5. 23
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

52 records
  • CVE-2026-23760
    96Now

    SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

    CriticalCVSS 9.3KEVWeaponizedEPSS 96%

    smartertools · smartermailJan 22, 2026

  • CVE-2025-52691
    96Now

    Upload Arbitrary Files

    CriticalCVSS 10.0KEVWeaponizedEPSS 85%

    smartertools · smartermailDec 29, 2025

  • CVE-2026-24423
    93Now

    SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

    CriticalCVSS 9.3KEVWeaponizedEPSS 88%

    smartertools · smartermailJan 23, 2026

  • CVE-2019-7214
    64This week

    SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.

    CriticalCVSS 9.8WeaponizedEPSS 84%

    smartertools · smartermailApr 24, 2019

  • CVE-2011-2148
    42Plan

    Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involvi

    CriticalCVSS 10.0No exploitEPSS 5%

    smartertools · smarterstatsMay 20, 2011

  • CVE-2011-2158
    41Plan

    The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers

    CriticalCVSS 10.0No exploitEPSS 4%

    smartertools · smarterstatsMay 20, 2011

  • CVE-2011-2159
    41Plan

    The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have

    CriticalCVSS 10.0No exploitEPSS 4%

    smartertools · smarterstatsMay 20, 2011

  • CVE-2011-4752
    41Plan

    SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an

    CriticalCVSS 10.0No exploitEPSS 1%

    smartertools · smarterstatsDec 16, 2011

  • CVE-2021-32234
    40Plan

    SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.

    CriticalCVSS 9.8No exploitEPSS 2%

    smartertools · smartermailNov 17, 2021

  • CVE-2019-7213
    38Monitor

    SmarterTools SmarterMail 16.x before build 6985 allows directory traversal.

    MediumCVSS 6.5Proof of conceptEPSS 41%

    smartertools · smartermailApr 24, 2019

  • CVE-2026-7807
    34Monitor

    SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API

    HighCVSS 8.7No exploitEPSS 0%

    smartertools · smartermailMay 8, 2026

  • CVE-2004-2583
    32Monitor

    SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a

    HighCVSS 7.8No exploitEPSS 1%

    smartertools · smartermailDec 31, 2004

  • CVE-2020-29548
    32Monitor

    An issue was discovered in SmarterTools SmarterMail through 100.0.7537.

    HighCVSS 8.1No exploitEPSS 1%

    smartertools · smartermailAug 17, 2021

  • CVE-2019-7212
    32Monitor

    SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys.

    HighCVSS 8.2No exploitEPSS 1%

    smartertools · smartermailApr 24, 2019

  • CVE-2026-40514
    32Monitor

    SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

    HighCVSS 8.2No exploitEPSS 0%

    smartertools · smartermailApr 27, 2026

  • CVE-2011-2155
    31Monitor

    Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autoc

    HighCVSS 7.5No exploitEPSS 3%

    smartertools · smarterstatsMay 20, 2011

  • CVE-2011-2149
    31Monitor

    Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL comma

    HighCVSS 7.5No exploitEPSS 2%

    smartertools · smarterstatsMay 20, 2011

  • CVE-2022-24387
    29Monitor

    File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

    HighCVSS 7.2No exploitEPSS 2%

    smartertools · smartertrackMar 14, 2022

  • CVE-2020-36926
    27Monitor

    SmarterTools SmarterTrack 7922 -Information Disclosure

    MediumCVSS 6.9No exploitEPSS 0%

    smartertools · smartertrackJan 15, 2026

  • CVE-2026-25067
    27Monitor

    SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion

    MediumCVSS 6.9No exploitEPSS 0%

    smartertools · smartermailJan 29, 2026

  • CVE-2022-24385
    26Monitor

    Information disclosure via direct object access on SmarterTrack v100.0.8019.14010

    MediumCVSS 6.5No exploitEPSS 0%

    smartertools · smartertrackMar 14, 2022

  • CVE-2022-24384
    25Monitor

    Reflective XSS on SmarterTrack v100.0.8019.14010

    MediumCVSS 6.1Proof of conceptEPSS 4%

    smartertools · smartertrackMar 14, 2022

  • CVE-2017-14620
    25Monitor

    SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in S

    MediumCVSS 6.1Proof of conceptEPSS 2%

    smartertools · smarterstatsSep 29, 2017

  • CVE-2015-9276
    24Monitor

    SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms.

    MediumCVSS 6.1No exploitEPSS 1%

    smartertools · smartermailJan 16, 2019

  • CVE-2022-24386
    24Monitor

    Stored XSS in SmarterTrack v100.0.8019.14010

    MediumCVSS 6.1No exploitEPSS 0%

    smartertools · smartertrackMar 14, 2022