Alinto vulnerabilities
We track 6 vulnerabilities in Alinto products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest Alinto vulnerabilities
- 7.4 High severity
sogo: Improper Restriction of Excessive Authentication Attempts
SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeate
- 7.4 High severity
sogo: Improper Restriction of Excessive Authentication Attempts
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint witho
- 8.3 High severity
SOGo: Weak Password Recovery Mechanism for Forgotten Password
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a
- 8.1 High severity
SOGo Webmail: Improper Neutralization of Special Elements used in an SQL Command
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the a
- 7.1 High severity
SOGo: Improper Neutralization of Special Elements used in an SQL Command
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- 7.5 High severity
SOPE: NULL Pointer Dereference
In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.