84 matches found
CVE-2020-12625
CVE-2020-12625: Roundcube Webmail의 악성 HTML 첨부 파일을 통한 크로스 사이트 스크립팅XSS 1.4.4, 1.3.11 및 1.2.10 이전 버전의 Roundcube에는 크로스 사이트 스크립팅XSS 취약점이 존재합니다. "text/html" 첨부 파일이 포함된 메일에서 "" XML 요소를 활용하면, 공격자는 Roundcube 스크립트 필터를 우회하고 악성 이메일을 클릭했을 때 피해자 브라우저에서 임의의 악성 JavaScript를 실행할 수 있습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개...
EUVD-2026-58243
django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...
CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments
django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...
Fake LinkedIn emails abuse Adobe to track victims
Cybercriminals are abusing Adobe infrastructure in a LinkedIn phishing campaign that steals passwords and redirects victims to the legitimate LinkedIn site afterward. The phishing email masquerades as a business inquiry designed to look like it's come via LinkedIn and includes a fake “contract”...
EUVD-2026-18581
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment...
GHSA-X4Q5-8J5G-HPJC Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the preview process. An attacker can execute arbitrary scripts in the context of the user's browser by convincing a victim to preview a specially crafted text/html attachment. Details Cross-site scripting or...
CVE-2026-35539
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment...
CVE-2026-35539
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment...
CVE-2026-35539
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment...
The Anatomy of HTML Attachment Phishing
The Anatomy of HTML Attachment Phishing: One Code, Many Variants By Niranjan Hegde and Sijo Jacob · June 14, 2023 This blog was also written by Mathanraj Thangaraju Introduction Phishing is the malevolent practise of pretending to be a reliable entity in electronic communication to steal sensitiv...
Linux Distros Unpatched Vulnerability : CVE-2025-66420
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67. CVE-2025-66420 Note that Nessus...
CVE-2025-66420
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
EUVD-2025-199921
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
GHSA-XHGV-99MJ-8M2X Tryton sao allows XSS via an HTML attachment
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
DEBIAN-CVE-2025-66420
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
CVE-2025-66420
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
CVE-2025-66420
The CVE-2025-66420 vulnerability affects Tryton sao (tryton-sao) prior to version 7.6.9, due to an HTML attachment that enables cross-site scripting (XSS). The underlying issue is an input/output handling flaw in HTML attachments that allows injected scripts to be executed in the context of the u...
CVE-2025-66420: Improper Neutralization of Input During Web Page Generation
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
