96 matches found
Email Log < 2.4.7 - Admin+ SQL Injection
The plugin does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections https://example.com/wp-admin/admin.php?page=email-log&orderby=sentdate+AND+SELECT+3025...
Email Log < 2.4.7 - Admin+ SQL Injection
The plugin does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections PoC https://example.com/wp-admin/admin.php?page=email-log=sentdate+AND+SELECT+3025 FROM+SELECTSLEEP5SBat=DESC...
Post SMTP Mailer/Email Log < 2.0.21 - CSRF Nonce Bypass
A user could bypass the nonce check associated with Export mail to CSV handleCsvExport function PoC Submit a request w/o the post-smtp-log-nonce parameter...
WordPress Post SMTP Mailer/Email Log plugin <= 2.0.20 - Cross-Site Request Forgery (CSRF) nonce validation vulnerability
Cross-Site Request Forgery CSRF nonce validation vulnerability found in WordPress Post SMTP Mailer/Email Log plugin versions = 2.0.20. Solution Update the WordPress Post SMTP Mailer/Email Log plugin to the latest available version at least 2.0.21...
CVE-2021-3032
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of...
Exploit for OS Command Injection in Oscommerce
PoC exploit for CVE-2020-27976, an authenticated remote code exe...
CVE-2019-18982
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...
CVE-2019-18982
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...
Code injection
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...
CVE-2019-18982
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...
CVE-2019-18982
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header...
CVE-2019-18982
CVE-2019-18982 affects Pimcore prior to version 6.3.0, where the file bundles/AdminBundle/Controller/Admin/EmailController.php in the Email Log preview window can execute scripts due to a missing Content-Security-Policy header. The vulnerability is documented across multiple sources (NVD entry, R...
CVE-2018-7747
Multiple cross-site scripting XSS vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a greeting message, 2 the email transaction log, or 3 an imported form...
CVE-2018-7747
Multiple cross-site scripting XSS vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a greeting message, 2 the email transaction log, or 3 an imported form...
WordPress Email Log plugin <=2.2.2 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by Yehuda in WordPress Email Log plugin versions =2.2.2. Solution Update the WordPress Email Log plugin to the latest available version at least 2.2.3...