MailEnable versions prior to 10.55 contain a reflected cross‑site scripting flaw in the webmail interface. The StartDate parameter in FreeBusy.aspx is inserted into dynamically generated JavaScript without proper sanitization, enabling an attacker to craft a malicious URL that injects arbitrary JavaScript which runs in the victim’s browser. Successful exploitation lets the attacker execute client‑side code, potentially stealing session cookies or performing other malicious actions.

The vulnerability affects the MailEnable Standard Edition and any other MailEnable edition using the standard webmail interface in releases older than 10.55. The flaw is present in all affected builds that include the FreeBusy.aspx page.

The CVSS base score of 5.1 indicates moderate severity, and the EPSS score of less than 1 % points to a low likelihood of exploitation. The issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no widespread active exploitation yet. Based on the description, it is inferred that attackers need only a publicly accessible webmail interface; no authentication or privileged access is required. The exploit is delivered client‑side via a crafted URL, making prevention rely on patching the server.