CLEANSTART-2024-BR87657 By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays

Security vulnerability affects the thunderbird package. By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays...

CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

Synacor Zimbra Collaboration cross-site scripting vulnerability

Versions of Synacor Zimbra Collaboration prior to 10.1.21 contain a cross-site scripting vulnerability. This flaw stems from improper sanitization of the From email header value, potentially enabling stored cross-site scripting attacks. Attackers can send specially crafted emails containing...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

EUVD-2026-69652

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524: Improper Neutralization of Input During Web Page Generation

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2025-12718

The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcfvalidateform' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers t...

EUVD-2024-37586

Malicious code in bioql PyPI...

CVE-2024-38738

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Marian Kadanka Change From Email allows Stored XSS.This issue affects Change From Email: from n/a through 1.2.1...

CVE-2024-38738

CVE-2024-38738 is a stored XSS in the WordPress Change From Email plugin affecting versions up to 1.2.1. The vulnerability arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Public sources consistently reference Change From Email

CVE-2024-38738 WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Marian Kadanka Change From Email allows Stored XSS.This issue affects Change From Email: from n/a through 1.2.1...

PT-2024-28182 · Unknown · Change From Email

Name of the Vulnerable Software and Affected Versions: Change From Email versions 1.2.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

CVE-2024-38738: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Marian Kadanka Change From Email allows Stored XSS.This issue affects Change From Email: from n/a through 1.2.1...

WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Change From Email versions = 1.2.1...

WordPress Change From Email Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Change From Email Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38738 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 281e9f01ebf2 Credits Cronus Required privilege Administrato...

WordPress plugin WPFrom Email: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Ubuntu 16.04 ESM / 18.04 ESM : PHPMailer vulnerability (USN-5956-2)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-5956-2 advisory. USN-5956-1 fixed vulnerabilities in PHPMailer. It was discovered that the fix for CVE-2017-11503 was incomplete. This update fixes the problem. Tenabl...

CVE-2020-12397

By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird 68.8.0...