Code injection

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...

PT-2020-7259

Name of the Vulnerable Software and Affected Versions: Basic webmail module versions 6.x-1.x before 6.x-1.2 Description: The issue allows remote authenticated users with the access basic webmail permission to read arbitrary users' email addresses. Recommendations: For Basic webmail module version...

CVE-2012-5570: Exposure of Sensitive Information to an Unauthorized Actor

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...

CVE-2012-5569

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

PT-2012-6030

Name of the Vulnerable Software and Affected Versions Drupal Basic webmail module version 6.x-1.x before 6.x-1.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via a page title or a crafted email message, potentially leading to cross-site scripting XSS attack...

CVE-2012-5569: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...