95 matches found
CVE-2026-34828
CVE-2026-34828 listmonk의 비밀번호 재설정 및 변경 후 세션 유지 소개 저는 listmonk 라는 오픈소스 뉴스레터 및 메일링 리스트 관리자를 검토하면서 이 문제를 발견했습니다. 간단한 보안 질문 하나를 염두에 두고 있었죠. 사용자가 비밀번호를 변경하거나 재설정하면, 애플리케이션이 실제로 이미 발급된 세션을 종료합니까? 이 경우, 그렇지 않았습니다. 이전에 발급된 인증 세션은 다음 두 가지 경우 모두에서 유효하게 남아 있었습니다: 비밀번호 재설정 비밀번호 변경 즉, 도난당한 세션 쿠키가 사용자가 계정을 복구하...
GHSA-VFP3-V2GW-7WFQ vulnerabilities
Vulnerabilities for packages: temporal, kube-metrics-adapter-fips, temporal-ui-server, temporal-fips, temporal-ui-server-fips, kube-metrics-adapter, listmonk, falcosidekick-ui, falcosidekick-ui-fips...
GO-2025-4239 vulnerabilities
Vulnerabilities for packages: listmonk...
GO-2026-4815 vulnerabilities
Vulnerabilities for packages: mailpit-fips, seaweedfs-fips, mattermost, mattermost-fips, hugo, hugo-fips, seaweedfs-operator-fips, rclone-fips, seaweedfs-operator, listmonk, ollama-fips, rclone, ollama, mailpit, seaweedfs, hugo-extended...
GO-2026-5066 vulnerabilities
Vulnerabilities for packages: seaweedfs-fips, mattermost-fips, mattermost, hugo, seaweedfs-operator-fips, rclone-fips, seaweedfs-operator, listmonk, rclone, gitlab-workhorse-ce, seaweedfs...
GO-2026-5320 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-streamanalytics, crossplane-provider-aws-ec2, crossplane-provider-aws-evidently-fips, crossplane-provider-aws-kinesisanalytics, crossplane-provider-gcp-beta-container, crossplane-provider-aws-elasticache-fips,...
SUSE CVE-2026-34828
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...
CVE-2026-62361
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361
CVE-2026-62361 affects listmonk prior to version 6.2.0. The vulnerability arises in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport without calling validateQueryTables, unlike GET /api/subscribers. An authenticated user with...
CVE-2026-62361: Improper Neutralization of Special Elements used in an SQL Command
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
GO-2026-5414 listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk...
listmonk Admin Authentication / Password Flow Security Assessment Module
This Metasploit auxiliary module is a web application security testing tool designed to evaluate authentication and password management logic in a Listmonk admin panel deployment...
CVE-2026-34584
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...
CVE-2026-34828
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...
CVE-2026-34828
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...
CVE-2026-34584
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...