MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability.

Last Modified: Apr 15, 2026

Published: Nov 05, 2025

CVE-2025-3929

Stored XSS vulnerability in MDaemon Email Server

Last Modified: May 12, 2025

Published: Apr 29, 2025

CVE-2024-11182

Stored XSS vulnerability in MDaemon Email Server

Last Modified: Oct 30, 2025

Published: Nov 15, 2024

CVE-2023-52269

MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators.

Last Modified: Nov 21, 2024

Published: Dec 31, 2023

CVE-2002-1739

Alt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user passwords, which allows local users to crack passwords.

Last Modified: Apr 16, 2026

Published: Dec 31, 2002

Items Per Page