CVE-2025-30191

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedur...

CVE-2025-30191

Open-Xchange OX App Suite is affected by CVE-2025-30191. The issue involves malicious email content exploited to trigger redressing attacks, allowing users to perform unintended actions or disclose information. The underlying cause, as stated, is the sanitization procedure that now denies attribu...

CVE-2025-30191

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedur...

CVE-2025-30191

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedur...

CVE-2025-30191

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedur...

EUVD-2025-37316

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedur...

CVE-2025-11191

The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site...

CVE-2025-11191 RealPress < 1.1.0 - Unauthenticated Content Creation/Email Sending via REST

The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site...

CVE-2025-11191 RealPress < 1.1.0 - Unauthenticated Content Creation/Email Sending via REST

The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site...

CVE-2025-11191

The RealPress WordPress plugin, in versions prior to 1.1.0 , is vulnerable to an authentication bypass due to the registration of REST routes without proper permission checks. This flaw allows unauthenticated attackers to perform unauthorized actions, specifically the creation of pages and the se...

EUVD-2025-37217

Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent...

PT-2025-44595

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Malicious content delivered via email can be leveraged to conduct a redressing attack. This allows attackers to deceive users into performing unintended actions or disclosing sensitive information to...

Curfew e-Pass Management System admin-profile.php file cross-site scripting vulnerability

Curfew e-Pass Management System is an electronic pass management system. Curfew e-Pass Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter adminname or email in the file...

CVE-2025-11191: Missing Authorization

The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site...

CVE-2025-11975: Missing Authorization

The FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savechanges function in all versions up to, and including,...

Security vulnerabilities in Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4

The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. A security vulnerability exists in the Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 that stems from disabling email server...

Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 Command Execution Vulnerabilities

The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 Command Execution Vulnerability A command execution vulnerability exists due to...

PT-2025-44648

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description The email server certificate verification is disabled, which allows for trivial man-in-the-middle MITM attacks. This poses a catastrophic security risk. Recommendation...

Open-Xchange OX App Suite security vulnerabilities

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite that stems from malicious email content that can be used to perform redirection attacks, potentially causing users to perform unintended actions or...

PT-2025-44666

Name of the Vulnerable Software and Affected Versions ELOG affected versions not specified Description The ELOG platform, an electronic logbook system, has an issue where an authenticated attacker with low privileges can modify another user's profile. Specifically, an attacker can alter a target...