EUVD-2026-67160

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

Arbitrary Code Injection

Overview silverstripe/userforms is a module that provides a visual form builder for the SilverStripe CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the userforms email subject process. An attacker can execute arbitrary code on the server by submitting a...

silverstripe/userforms vulnerable to remote code execution via userforms email subject

Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server. Reported by Jack Wallace from Bastion Security...

GHSA-G8WR-R2V2-VQC6 silverstripe/userforms vulnerable to remote code execution via userforms email subject

Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server. Reported by Jack Wallace from Bastion Security...

EUVD-2026-67239

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721

Silverstripe UserForms (a visual form builder module for Silverstripe CMS) contains a remote code execution vulnerability in the email recipient subject field. Between versions 6.0.0 and the fixed releases, a specially crafted payload in the subject field is interpreted as executable server-side ...

SUSE CVE-2026-77508

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...

CVE-2026-81707 openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81707 openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

EUVD-2026-67063

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827

Flowintel versions >=3.3.0 contained a validation flaw in the login flow: the code called Email(email) (which only constructs a WTForms validator object) instead of Email()(form, form.email), so malformed attacker-supplied email values bypassed validation. Because CR/LF characters in the email...

EUVD-2026-67133

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.33...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability

Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability discovered by Artus KG in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress GeoDirectory plugin < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users vulnerability

Contributor+ User Email Disclosure via geodirjsonsearchusers vulnerability discovered by Vaibhav Narkhede in WordPress Plugin GeoDirectory versions 2.8.168...