Joomla 3.0.x < 3.10.17 / 4.0.x < 4.4.7 / 5.0.x < 5.1.3 Multiple Vulnerabilities (5910-joomla-5-1-3-and-4-4-7-security-and-bug-fix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 3.10.17, 4.0.x prior to 4.4.7, or 5.0.x prior to 5.1.3. It is, therefore, affected by multiple vulnerabilities. - Inadequate validation of URLs could result into an invalid check...

CVE-2024-27186

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2024-27186

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2024-27186

The Joomla! content management system is vulnerable to Cross-Site Scripting (XSS) due to a lack of an escaping mechanism in the mail template feature. This flaw allows for XSS vectors across multiple extensions. Affected versions include Joomla! 3.0.x prior to 3.10.17, 4.0.x through 4.4.6, and 5....

CVE-2024-27186 [20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2024-27186 [20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

PT-2024-21721 · Joomla +2 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. No information is provided about the estimated number...

CVE-2023-40281

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using t...

EC-CUBE 2 series vulnerable to cross-site scripting

Overview EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability CWE-79 in "mail/template" and "products/product" of Management page. Shimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD...

PT-2023-27357 · Ec Cube · Ec-Cube

Name of the Vulnerable Software and Affected Versions: EC-CUBE versions 2.11.0 through 2.17.2-p1 Description: The issue concerns a cross-site scripting vulnerability in the "mail/template" and "products/product" sections of the Management page. If exploited, this could lead to the execution of an...

feembox (>=0.1.0, <=0.1.1), mail (>=0.6.0, <=0.7.0) +5 more potentially affected by unknown CVE via mail-internals (0.2.3)

mail-internals CARGO version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on mail-internals and may be impacted: - feembox =0.1.0, =0.6.0, =0.6.0, =0.6.0-wip, =0.2.0, =0.6.0, =0.1.0, =0.1.2 Source cves: unknown CVE Source advisory:...

PT-2022-24373 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.4.0 Description: A stored cross-site scripting XSS issue was found in the e-mail template modules. This allows for malicious scripts to be stored and executed when the module is accessed. Recommendations: For Vtiger CRM...

Cross-Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The vulnerability exists as there was a lack of sanitization on the value of $valuetoshow in admin/mailstemplate.php...

Design/Logic Flaw

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template...

CVE-2016-7844

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template...

CVE-2016-7844

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template...

CVE-2016-7844

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template...

CVE-2016-7844

CVE-2016-7844 is linked to GigaCC OFFICE, with affected versions up to 2.3 and earlier. The connected JVN entry (J VNDB-2017-001053) identifies the root cause as a misconfiguration of the Apache Velocity template engine used for sending emails. This misconfiguration can allow a remote attacker to...

CVE-2014-1571

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template...

CVE-2014-1571

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template...