60 matches found
EUVD-2019-8841
Malware in sbrugna...
EUVD-2021-28342
Malicious code in bioql PyPI...
EUVD-2025-17108
Malicious code in bioql PyPI...
EUVD-2024-20347
Malicious code in bioql PyPI...
CVE-2025-59041 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with git config user.email. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. User...
CVE-2025-22829 Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for...
CVE-2025-5755
A vulnerability was found in SourceCodester Open Source Clinic Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /emailconfig.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The...
CVE-2024-22817
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/email/emailconfupdagte...
CVE-2024-22817
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/email/emailconfupdagte...
CVE-2024-22817
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/email/emailconfupdagte...
FlyCms Security Vulnerability
sunkaifei FlyCms is sunkaifei open source application . A similar to Zhihu to Q&A based on the fully open source JAVA language development of social networking site builder . FlyCms security vulnerabilities , the vulnerability stems from /system/email/emailconfupdagte location cross-site request...
PortSwigger Web Security: A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts
The vulnerability allowed a user with only the "MODIFYSETTINGS" permission to take over any user accounts. By configuring the email settings to use a public SMTP server, the attacker could capture the email and password reset link whenever an administrator or user with permissions to edit or add...
SMTP server credentials are returned
Description The vulnerability discovered in the Calibre-Web application is a security flaw in the management of email configurations that allows the SMTP server credentials to be viewed by an account with editing permission. This could allow a malicious user with access to the administrative...
IDOR on save email configuration leads to account takeover
Description An attacker with a low privileged account on the latest GLPI version could change other user´s email when saving his own user preferences. After that, if "Forgot password" is enabled via email, an attacker will be able to retrieve victim´s forgot password link to the modified email to...
Stack overflow
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtpemailsubject parameter at /goform/formSetEmail...
CVE-2022-4312
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service SMS accounts configuration files to discover the associated simple mail transfer protocol SMTP account...
Input validation
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...
CVE-2022-27545 HCL BigFix Web Reports authorized users may perform HTML injection.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...