The vulnerability is a stored cross‑site scripting flaw in the Axigen Mail Server WebMail component before versions 10.6.39 and 10.7.1. An unauthenticated attacker can send an email whose From display name contains malicious HTML and JavaScript; when a recipient opens the conversation view, the script runs in the browser with the recipient's credentials, allowing the attacker to capture mailbox contents or redirect the user to a malicious site, thereby compromising confidentiality and session integrity.

The flaw affects Axigen Mail Server releases prior to 10.6.39 and 10.7.1, from Axigen Inc. Versions earlier than 10.6.39 for the 10.6 series and earlier than 10.7.1 for the 10.7 series are vulnerable; administrators should verify that their installations run a patched version.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is not available while it is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a crafted message; no authentication or privileged access is required. Given the ease of exploitation and potential for data theft, the risk for exposed systems is non‑negligible and requires timely remediation.