MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
No PoCs from references.
- https://github.com/Dmitriy-area51/Exploit