CVE-2025-14004 dayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgery

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is...

curl: SMTP Protocol Injection via CRLF in CURLOPT_MAIL_FROM leading to Email Spoofing

Voici le rapport complet et finalisé. J'ai intégré la version spécifique de curl que vous avez fournie et j'ai ajouté une section détaillée "Vulnerable Code Analysis" avec les extraits de code expliqués, comme demandé. J'ai retiré la section Impact conformément à votre consigne. Summary: A critic...

xunruicms code issues and vulnerabilities

xunruicms is a website builder framework for XunRuiCMS individual developers. A code issue vulnerability exists in xunruicms 4.7.1 and earlier versions, which stems from incorrect manipulation of the component Email Setting Handler in the file /admind45f74adbd95.php, which can lead to server-side...

PT-2025-49192

Name of the Vulnerable Software and Affected Versions WordPress CRM Memberships plugin versions up to and including 2.5 Description The CRM Memberships plugin for WordPress is susceptible to privilege escalation through a password reset function. The issue stems from a lack of proper authorizatio...

CVE-2025-14004: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting Handler. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is...

PT-2025-49022

Name of the Vulnerable Software and Affected Versions XunRuiCMS versions up to 4.7.1 Description A security flaw exists in XunRuiCMS, specifically within the Email Setting Handler component. The issue involves server-side request forgery, potentially allowing remote exploitation. The flaw is...

Malicious code in email-regexed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a196eb68421b32096da5ff260a7a9aca6f9d74937768b62ae4aff437c0c89729 The package email-regexed was found to contain malicious code. Source: ghsa-malware 0dac0855a64ab32c42fcd0ab7694e81f0ca1ba1cbedb27990dad05e7162c51e1...

EUVD-2025-201135

Malicious code in email-regexed npm...

MAL-2025-192292 Malicious code in email-validated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16af72446800f2251ecdda400ad30c23637f628d1487ae5c911bb4283e3fe10c The package email-validated was found to contain malicious code. Source: ghsa-malware 9f2a0d9794c8d949cc051fe3c306af63ddb55b6848d0607ef1f5d332585a2fc...

EUVD-2025-201134

Malicious code in email-validated npm...

Malicious Package

Overview email-regexed is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in email-regexed

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-192291 Malicious code in email-regexed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a196eb68421b32096da5ff260a7a9aca6f9d74937768b62ae4aff437c0c89729 The package email-regexed was found to contain malicious code. Source: ghsa-malware 0dac0855a64ab32c42fcd0ab7694e81f0ca1ba1cbedb27990dad05e7162c51e1...

Malicious code in email-validated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16af72446800f2251ecdda400ad30c23637f628d1487ae5c911bb4283e3fe10c The package email-validated was found to contain malicious code. Source: ghsa-malware 9f2a0d9794c8d949cc051fe3c306af63ddb55b6848d0607ef1f5d332585a2fc...

Malware in email-validated

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2024-30444

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6...

CVE-2024-32642 Host header poisoning allows account takeover via password reset email

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6...

CVE-2024-32642

Masa CMS is vulnerable to host header poisoning before versions 7.2.8, 7.3.13, and 7.4.6. This defect can enable account takeover via the password reset email by manipulating the host header. The issue is fixed in 7.2.8, 7.3.13, and 7.4.6. Remediation is to upgrade Masa CMS to one of the fixed ve...

CVE-2024-32642 Host header poisoning allows account takeover via password reset email

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6...

EUVD-2025-200979

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run save handler. This makes it...