MailEnable versions prior to 10.55 suffer from a reflected cross‑site scripting flaw in the webmail interface. The Attendees parameter in FreeBusy.aspx is inserted into JavaScript without proper sanitization, allowing an attacker to supply a URL that injects arbitrary JavaScript which executes in the victim’s browser. Successful exploitation lets the attacker run client‑side code, potentially stealing session cookies or performing other malicious actions.

The vulnerability affects the MailEnable Standard Edition and any other MailEnable edition using the standard webmail interface in releases older than 10.55. The flaw is present in all affected builds that include the FreeBusy.aspx page.

The CVSS base score of 5.1 indicates moderate severity, and the EPSS score of less than 1 % points to a low likelihood of exploitation. The issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no widespread active exploitation yet. Attackers need only a publicly accessible webmail interface; no authentication or privileged access is required. The exploit is delivered client‑side via a crafted URL, making prevention rely on patching the server.