Merak Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 is susceptible to cross site scripting and directory traversal attacks.