CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

Sextortion scammers are exploiting ShinyHunters data leaks

Sextortion scammers are using email addresses from data leaked by the ShinyHunters hacking group to add some credibility to their feeble attempts to convince people they have embarrassing information about them. Sextortion emails are messages claiming that the scammer recorded you through your...

EUVD-2026-49213

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59537

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-16367

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Disability Access APIs component...

Important: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

PT-2026-65089

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A missing uniqueness constraint allows authenticated administrators to create duplicate client accounts using identical email and password credentials. The lack of enforcement on th...

PT-2026-64932

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59239: Improper Neutralization of Input During Web Page Generation

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

PT-2026-65087

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59537: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

user-scanner v1.4.2

User Scanner A powerful 2-in-1 OSINT suite engineered for deep Email and Username Intelligence. With 380+ total scan vectors —including 155+ email-integrated sites and 225+ username platforms —you can map digital footprints, analyze target behavior, uncover interests, full metadata of usernames a...

Information Exposure

Overview @budibase/worker is a Budibase background service Affected versions of this package are vulnerable to Information Exposure in the login lockout process. An attacker can determine whether an email address is registered by sending multiple login attempts and observing differences in the...

GHSA-HR66-5MQR-8MPX Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLICENDPOINTS list with a TODO comment acknowledging it...

GHSA-HP6V-6JW7-GV2F Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...

Improper Authentication

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Improper Authentication in the OIDC SSO authentication process. An attacker can gain unauthorized access to an existing user account, including accoun...

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...

Authorization Bypass Through User-Controlled Key

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the POST /api/v2/email process. An attacker can gain unauthorized access to another user's account by supplying a victim's accountId and an...