Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.
| Software | From | Fixed in |
|---|---|---|
| aeromail / aeromail | 1.30 | 1.30.x |
| aeromail / aeromail | 1.26 | 1.26.x |
| aeromail / aeromail | 1.20 | 1.20.x |
| aeromail / aeromail | 1.40 | 1.40.x |
| aeromail / aeromail | 1.02 | 1.02.x |
| aeromail / aeromail | 1.10 | 1.10.x |