CVE-2025-49028: XSS in Zoho ZeptoMail

The XSS vulnerability in Zoho ZeptoMail allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a victim's browser when they visit a crafted URL. Successful exploitation could lead to session hijacking, account takeover, defacement of the ZeptoMail interface, or the theft of sensitive information such as email content and credentials. The 'Stored XSS' nature of the vulnerability means the malicious script persists on the server, making it a persistent threat to all users who interact with the affected functionality.

1. Reserved2025-05-30
2. Published2025-12-31
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-49028 is to immediately upgrade Zoho ZeptoMail to version 3.3.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to filter out suspicious input in the transmail functionality. Carefully review and sanitize all user-supplied input before rendering it in the ZeptoMail interface. Monitor ZeptoMail logs for unusual activity or suspicious script injections. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the transmail feature and verifying it is not executed.

Active installs

5KNiche

Plugin rating