MailEnable versions earlier than 10.55 contain a reflected cross-site scripting vulnerability in the FreeBusy.aspx page. The flaw allows a remote attacker to construct a URL that injects arbitrary JavaScript into the StartDate parameter, which is echoed into client-side code without proper sanitization. When a user visits the crafted link, the malicious script runs in that user’s browser, enabling client-side attacks such as redirecting the user or manipulating the browsing context.

This vulnerability impacts all MailEnable installations running any version prior to 10.55. The flaw is located in the webmail interface component FreeBusy.aspx and is not limited to specific product editions.

The CVSS base score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a maliciously crafted URL; no authentication or local privileges are needed, making the attack vector remote client interaction.