96 matches found
WordPress 4.5.x < 4.5.28 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
WP < 6.0.3 - Email Address Disclosure via wp-mail.php
Description WordPress discloses the sender's email address via wp-mail.php...
WP < 6.0.3 - Stored XSS via wp-mail.php
Description WordPress does not properly sanitize some parameters when receiving a post by email, which could lead to Stored Cross-Site Scripting issue...
WordPress core <= 6.0.2 - Sender’s Email Address Exposure vulnerability
Sender’s Email Address Exposure vulnerability via wp-mail.php was discovered by Toshitsugu Yoneyama Mitsui Bussan Secure Directions, Inc. via JPCERT in the WordPress core versions = 6.0.2. Solution Update the WordPress to the latest available version at least 6.0.3...
WordPress core <= 6.0.2 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability via wp-mail.php discovered by Toshitsugu Yoneyama Mitsui Bussan Secure Directions, Inc. via JPCERT in WordPress core versions = 6.0.2 Solution Update the WordPress to the latest available version at least 6.0.3...
WP < 6.0.3 - Stored XSS via wp-mail.php
WordPress does not properly sanitize some parameters when receiving a post by email, which could lead to Stored Cross-Site Scripting issue...
PT-2022-6990
Name of the Vulnerable Software and Affected Versions SolarView Compact version 6.00 Description The issue exists due to the failure to neutralize special elements used in an operating system command in the conf mail.php component of the SolarView Compact device. This can allow an attacker to...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
CVE-2020-27976: Improper Neutralization of Special Elements used in an OS Command
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
PT-2020-16883
Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for OS command injection remotely. It is caused by a vulnerable from POST parameter in the admin/mail.php file, which affects the PHP mail function and the sendmail -...
PT-2020-12467
Name of the Vulnerable Software and Affected Versions Gambio GX versions prior to 4.0.1.0 Description The issue allows SQL Injection in the admin/gv mail.php file. This could potentially lead to unauthorized access or manipulation of database content. No information is provided about the estimate...
WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...
miss-sporta.si XSS vulnerability
Open Bug Bounty ID: OBB-641468 Description| Value ---|--- Affected Website:| miss-sporta.si Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
topreality.sk XSS vulnerability
Open Bug Bounty ID: OBB-639723 Description| Value ---|--- Affected Website:| topreality.sk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
phpman89.de XSS vulnerability
Open Bug Bounty ID: OBB-626157 Description| Value ---|--- Affected Website:| phpman89.de Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A...
PT-2017-10996
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of authorization check in the code, specifically in the dtracker/save mail.php file, which allows unauthorized injection of new contacts into the wp contact table. Recommendations For...
szi-intern.de XSS vulnerability
Open Bug Bounty ID: OBB-242724 Description| Value ---|--- Affected Website:| szi-intern.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...