Repositories and security advisories on highlight several critical vulnerabilities in hMailServer
hmail-phish – Includes a fake PHP login portal and a listener. hmailserver exploit github