MDaemon Webmail (formerly WorldClient) has CSRF.
- http://packetstormsecurity.com/files/153686/WorldClient-14-Cross-Site-Request-Forgery.html
- https://packetstormsecurity.com/files/cve/CVE-2018-17792
- https://www.altn.com/Software/MDaemon-Webmail-WorldClient/
- https://github.com/ARPSyndicate/cvemon