pixiv: Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net

A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST...

CVE-2025-32947

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

CVE-2025-32947

CVE-2025-32947 concerns PeerTube. The connected documents describe a DoS via an infinite loop in the "+inbox+" endpoint triggered by crafted ActivityPub activities, causing the PeerTube server to stop responding to requests. Affected software is PeerTube; the root cause is an infinite loop in han...

PT-2025-16344 · Peertube · Peertube

Name of the Vulnerable Software and Affected Versions: PeerTube affected versions not specified Description: This vulnerability allows an attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the inbox endpoint when receiving crafted ActivityPub activitie...

CVE-2025-22927

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php=save...

PT-2025-14637 · Opensips · Opensis

Name of the Vulnerable Software and Affected Versions: openSIS versions 7.0 through 9.1 Description: A SQL injection issue was found in the Inbox module via the cp id parameter at the "/modules/messages/Inbox.php" API endpoint. Recommendations: For openSIS versions 7.0 through 9.1, as a temporary...

Oqtane Framework Insecure Direct Object Reference vulnerability

An IDOR Insecure Direct Object Reference vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging...

CVE-2024-55186

An IDOR Insecure Direct Object Reference vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging...

PT-2024-36490 · Unknown · Oqtane Framework

Name of the Vulnerable Software and Affected Versions: oqtane Framework version 6.0.0 Description: An IDOR Insecure Direct Object Reference issue exists, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the...

CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instanc...

CVE-2024-50356 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn't be able to login by bypassing the 2FA. Onl...

PT-2024-34165 · Frappe · Press

Name of the Vulnerable Software and Affected Versions: Press versions prior to the version containing commit ba0007c28ac814260f836849bc07d29beea7deb6 Description: The issue concerns a password reset vulnerability in Press, a custom app for Frappe Cloud that manages various services including...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

SMSEagle 安全漏洞

SMSEagle is a specialized hardware SMS gateway software for sending and receiving SMS messages from SMSEagle, Inc. A security vulnerability exists in SMSEagle version 6.0 that stems from the application not properly cleaning user input from SMS messages in the inbox, leading to a stored cross-sit...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

PT-2024-27518 · Smseagle · Smseagle

Name of the Vulnerable Software and Affected Versions: SMSEagle versions prior to 6.0 Description: A stored Cross-Site Scripting XSS issue has been identified. The application did not properly sanitize user input in SMS messages in the inbox, allowing an attacker to inject malicious JavaScript co...

CVE-2024-38521

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-38521 Persistent Cross-Site Scripting (XSS) in hushline inbox

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-38521

Vulnerability: CVE-2024-38521 affects Hush Line prior to version 0.1.0, with a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and is not sanitized on display. Root cause (from PT-2024-28049): mis-handling of user-controlled input in the Inbox leads to stored XSS....