important · RCE
A malformed password can execute JScript in hMailServer when JScript password-validation events are enabled.
Affects
Progressive Robot hMailServer, a Windows SMTP, POP3 and IMAP mail server.
A backslash followed by an apostrophe can close the generated password string and inject JScript before authentication succeeds.
Detail and 2 sources
The path requires a known active username and the non-default OnClientValidatePassword JScript hook.
The upstream correction ships in hMailServer 6.3.4.