MailEnable versions before 10.55 contain a reflected cross‑site scripting flaw in the webmail interface. A malicious value supplied to the SelectedIndex parameter of ManageShares.aspx can be injected into client‑side script. When a user opens the crafted URL, the browser executes the injected JavaScript, allowing client‑side attacks such as data exfiltration or UI manipulation. This weakness is an input‑validation failure identified by CWE‑79.

The impacted product is the MailEnable mail server software. All installations running a version earlier than 10.55, regardless of platform or installation type, contain the unfiltered parameter in the standard webmail interface. Administrators should verify the exact version to determine if the system is vulnerable.

The CVSS base score of 5.1 indicates moderate severity, while an EPSS score of less than 1% suggests low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a victim who can open a crafted URL that references the vulnerable page; no authentication or privileged context is needed. The risk therefore lies primarily with users accessing the webmail interface, who may have client‑side code executed in their browsers.