CVE-2025-12374

CVE-2025-12374 (User Verification by PickPlugins) affects WordPress plugin User Verification (versions ≤ 2.0.39). Root cause: authentication bypass due to improper validation of OTP generation in user_verification_form_wrap_process_otpLogin, allowing unauthenticated logins with a verified email (...

CVE-2025-12374 Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.39 - Authentication Bypass to Account Takeover

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.39. This is due to the plugin not properly validating that an OTP was generate...

EUVD-2025-201358

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.39. This is due to the plugin not properly validating that an OTP was generate...

CVE-2025-13313

The CRM Memberships WordPress plugin is vulnerable in versions up to 2.5 due to missing authorization checks on the ntzcrm_changepassword AJAX action and an unauthenticated ntzcrm_get_users endpoint, enabling unauthenticated password resets and enumeration of subscriber emails. This can grant att...

CVE-2025-12374: Improper Authentication

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generate...

PT-2025-49228

Name of the Vulnerable Software and Affected Versions Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress versions up to and including 2.0.39 Description The plugin does not properly validate that an One-Time Passwo...

Email-MIME Resource Exhaustion

The vulnerability of the library for analyzing and processing MIME messages in Email-MIMEE is related to the unlimited distribution of resources. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures through specially created MIME messages...

Devolutions Server Unauthorized Access

The vulnerability of the email service of the Devolutions Server platform for centralized and secure management of passwords, account information, and confidential data is related to insufficient protection of sensitive data. Exploiting this vulnerability may allow an attacker operating remotely ...

SOGo <= 5.12.4 XSS Vulnerability

SOGo is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:alinto:sogo"; if...

PT-2025-49294

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 5.5.3 Description A stored HTML injection issue exists in the Mail app's message list, potentially allowing an authenticated user to inject HTML into email subjects. The Nextcloud Server’s content security poli...

CVE-2023-53734 dawa-pharma-1.0 - SQL Injection via Email Parameter

dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access...

CVE-2023-53734 dawa-pharma-1.0 - SQL Injection via Email Parameter

dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access...

CVE-2023-53734

CVE-2023-53734 affects dawa-pharma-1.0 and is described as an unauthenticated SQL injection vulnerability in the email parameter that allows arbitrary SQL queries on the server, leading to potential exposure of sensitive data and possible administrative access. The root cause is improper input ha...

CVE-2025-66223

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...

CVE-2025-14004

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is...

CVE-2025-14004

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is...

CVE-2025-14004

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is...

CVE-2025-14004 dayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgery

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is...

CVE-2025-14004

Dayrui XunRuiCMS is affected up to version 4.7.1. The vulnerability lies in the Email Setting Handler component, specifically the file /admind45f74adbd95.php?c=email&m=add, where manipulation enables server-side request forgery. Remote exploitation is possible and exploits have been released publ...

EUVD-2025-201162

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing manipulation results in server-side request forgery. Remote exploitation of the attack is...