Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Passwo...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten...

CVE-2026-110249 Denial-of-service in the Exchange email component

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...

CVE-2026-110249

Mozilla Thunderbird is affected by a Denial-of-Service (DoS) vulnerability in its Exchange email component . A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with sufficient attributes to keep Thunderbird's main threa...

CVE-2026-110249 Denial-of-service in the Exchange email component

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...

CVE-2026-109963

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109963

Froxlor versions prior to 2.3.14 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the email template editor via admin_templates.php. The root cause is that the system fetches the mail body using mailbodyid without performing an adminid ownership check. This allows...

CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admintemplates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...

CVE-2026-109114

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

CVE-2026-109115

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql...

CVE-2026-109115 AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql...

CVE-2026-109115

The AdithyaYelloju Restaurant-Management-System is vulnerable to a remote SQL injection flaw within the Password Reset component, specifically affecting the processing of the User/forgot3.php file. An attacker can initiate the attack remotely by manipulating the email/password arguments. While th...

EUVD-2026-98350

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql...

CVE-2026-109114

The AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) contains an improper authentication vulnerability in the Login Form component, specifically affecting the User/login.php file. Manipulation of the email/passwd arguments allows for remote unaut...

CVE-2026-109114 AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

EUVD-2026-98045

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactiona...

EUVD-2026-98164

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

EUVD-2026-98163

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...