poastal

Poastal - la herramienta OSINT de correo electrónico Poastal es una herramienta OSINT de correo electrónico que proporciona información valiosa sobre cualquier dirección de correo electrónico. Con Poastal, puedes ingresar fácilmente una dirección de correo electrónico y responderá rápidamente a...

CVE-2023-54412: Improper Access Control

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2026-109601: External Control of File Name or Path

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-107248: Improper Control of Generation of Code

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection SSTI flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker...

PT-2026-111019

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...

PT-2026-110877

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be...

CVE-2026-53997: Weak Password Recovery Mechanism for Forgotten Password

Netherman Portal del Hermano portaldelhermano.es before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all...

CVE-2026-108920: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...

CVE-2026-78359: Use of Multiple Resources with Duplicate Identifier

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend...

CVE-2026-109654: Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactiona...

PT-2026-110583

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

PT-2026-110949

Name of the Vulnerable Software and Affected Versions Netherman Portal del Hermano portaldelhermano.es versions prior to 2026-10-06 Description Broken authentication in the password-recovery flow allows unauthenticated attackers to take over member accounts across all tenants. The issue stems fro...

PT-2026-111001

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.3 Frappe versions 14.x prior to 14.21.1 Description Improper access control in Email Template permissions allows any authenticated non-guest user to create and edit any Email Template. This enables attackers with...

CVE-2026-109204: Weak Password Recovery Mechanism for Forgotten Password

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to...

CVE-2026-109629: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lis...

CVE-2026-109600: Missing Authorization

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...

PT-2026-110618

Name of the Vulnerable Software and Affected Versions Thelia version 3.0.0 Description The back-office Email/Messages feature contains a server-side template injection SSTI flaw. This issue allows authenticated users with the “Messages” permission to provide unsandboxed Twig templates, which the...

PT-2026-111067

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0 Description Authenticated attackers can trigger transactional emails for documents they are not permitted to read because certain endpoints fail to verify ...

Pizzafy 1.0 Shell Upload / SQL Injection

Pizzafy version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities. Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software:...

PT-2026-111020

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...