100 matches found
CVE-2026-34828
CVE-2026-34828 listmonk’s Session Persistence After Password Reset and Password Change Intro I found this issue while reviewing listmonk , an open-source newsletter and mailing list manager, with a simple security question in mind: When a user changes or resets a password, does the application...
GHSA-VFP3-V2GW-7WFQ vulnerabilities
Vulnerabilities for packages: temporal-fips, listmonk, falcosidekick-ui-fips, kube-metrics-adapter, temporal-ui-server, temporal-ui-server-fips, falcosidekick-ui, temporal, kube-metrics-adapter-fips...
GO-2025-4239 vulnerabilities
Vulnerabilities for packages: listmonk...
GO-2026-4815 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator, seaweedfs-fips, seaweedfs-operator-fips, mattermost-fips, hugo-extended, listmonk, hugo-fips, mailpit-fips, hugo, mailpit, mattermost, ollama-fips, rclone-fips, ollama, seaweedfs, rclone...
GO-2026-5066 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator, seaweedfs-fips, mattermost-fips, listmonk, hugo, mattermost, rclone-fips, seaweedfs-operator-fips, gitlab-workhorse-ce, seaweedfs, rclone...
GO-2026-5320 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cur, crossplane-provider-aws-s3, crossplane-provider-aws-autoscaling, crossplane-provider-azure-servicelinker, crossplane-provider-gcp-beta-networksecurity-fips, crossplane-provider-aws-macie2-fips, crossplane-provider-aws-neptune,...
SUSE CVE-2026-34828
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...
Listmonk Installer Exposure Detection
Listmonk is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Listmonk is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...
CVE-2026-62361
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
CVE-2026-62361
CVE-2026-62361 affects listmonk prior to version 6.2.0. The vulnerability arises in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport without calling validateQueryTables, unlike GET /api/subscribers. An authenticated user with...
CVE-2026-62361: Improper Neutralization of Special Elements used in an SQL Command
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...
GO-2026-5414 listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk...
listmonk Admin Authentication / Password Flow Security Assessment Module
This Metasploit auxiliary module is a web application security testing tool designed to evaluate authentication and password management logic in a Listmonk admin panel deployment...
CVE-2026-34584
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...
CVE-2026-34828
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...