CVE-2026-45127

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45127

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45127

MyBB versions prior to 1.8.40 have a CSRF flaw in the ACP Mass Mail Resend route: the admin/modules/user/mass_mail.php endpoint duplicates archived entries into new drafts (setting mybb_massemails.status = 0) on unprotected GET requests. A same-site attacker can trigger this via a crafted URL. Up...

CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

EUVD-2026-60977

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

PT-2026-77150

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71239

DjangoCRM: Mass Mail rendering flaw in three code paths (message_previews.py, email_creators.py, helpers.py) uses Django Template() on user-controlled EmlMessage fields without sanitization. This enables authenticated users with mass-mail edit rights to inject Django template syntax ({{ }}, {% %}...

CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

PHP Mass Mail 1.0 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: PHP Mass Mail 1.0 - Arbitrary File Upload Exploit Author: Ihsan Sencan Vendor Homepage: https://phpmassmail.sourceforge.io/ Software Link: https://netix.dl.sourceforge.net/project/phpmassmail/phpmassmail/1.0.0/phpmassmail.zip...

PHP Mass Mail 1.0 Shell Upload

Exploit Title: PHP Mass Mail 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://phpmassmail.sourceforge.io/ Software Link: https://netix.dl.sourceforge.net/project/phpmassmail/phpmassmail/1.0.0/phpmassmail.zip Version: 1.0 Category: Webapp...

PHP Mass Mail 1.0 - Arbitrary File Upload

Exploit Title: PHP Mass Mail 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://phpmassmail.sourceforge.io/ Software Link: https://netix.dl.sourceforge.net/project/phpmassmail/phpmassmail/1.0.0/phpmassmail.zip Version: 1.0 Category: Webapp...

PHP Mass Mail 1.0 - Arbitrary File Upload

PHP Mass Mail 1.0 - Arbitrary File Upload Exploit Title: PHP Mass Mail 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://phpmassmail.sourceforge.io/ Software Link:...

CodoForum 3.3.1 - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3...

WordPress WP Mass Mail Spoofing

Description : Wordpress Plugins - WP Mass Mail Send Mass Email Vulnerability Version : 2.45 Link : http://wordpress.org/extend/plugins/wp-mass-mail/ Plugins : http://downloads.wordpress.org/plugin/wp-mass-mail.zip Date : 26-05-2012 Google Dork : inurl:/wp-content/plugins/wp-mass-mail/ Author :...

VU Mass Mailer Authentication Bypass

Exploit for php platform in category web applications ==================================== VU Mass Mailer Authentication Bypass ==================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1...

Chipmunk NewsLetter - Cross-Site Request Forgery

Chipmunk NewsLetter - Cross-Site Request Forgery ------------------------------------------------------------------------------------------------- Title: Chipmunk Newsletter CSRF Vulnerabilities Author: Milos Zivanovic Date: 11. December 2009...