Vulnerability Details CVE-2025-52374
Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.9%
CVSS Severity
CVSS v3 Score 4.6
Products affected by CVE-2025-52374
-
cpe:2.3:a:hmailserver:hmailserver:5.6.9
-
cpe:2.3:a:hmailserver:hmailserver:5.8.6