CVE-2025-52463 Cross-site request forgery in Active! mail 6
Attackers can force logged-in users to send unintended emails via crafted URLs in Active! mail 6.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-52463?
CVE-2025-52463 is a low-severity vulnerability in QUALITIA CO., LTD. Active! mail 6, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and earlier. If this vulnerability is exploited, unintended E-mail may be sent when a user accesses a specially crafted URL while being logged in.
Weakness: CWE-352
Which versions are affected by CVE-2025-52463?
How do I fix CVE-2025-52463?
No fix has been published for CVE-2025-52463 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-52463 being exploited?
There is no known exploitation of CVE-2025-52463 in the wild and no public exploit code.
Sources
Also known as GHSA-4rg2-7c4x-vrww.