1701 matches found
paperweight
Paperweight website Marketing site for Paperweight. Development Install deps from the repo root, then run Next.js in this package: root@kitploit: pnpm -C website install pnpm -C website dev Production build root@kitploit: pnpm -C website build pnpm -C website start Environment variables This site...
Newsletter < 7.4.5 - Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
Newsletter < 7.6.9 - Cross-Site Scripting
The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...
Tautulli <= 2.16.1 - Path Traversal
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...
WordPress Email Newsletter - Reflected XSS
WordPress Email Newsletter plugin through 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to cra...
CVE-2026-86823
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...
EUVD-2026-80206
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...
CVE-2026-86823
The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination after a public subscription action, triggered via the ncu parameter. This flaw enables unauthenticated attackers to perform an open redirect to arbitrary external sites and to disclose a subscriber token , whi...
CVE-2024-33297
CVE-2024-33297 Microweber = 2.0.9 中的存储型跨站脚本漏洞 摘要： Microweber v.2.0.9 中存在一个存储型跨站脚本漏洞，允许远程攻击者通过“添加新活动”功能中的“活动名称（内部名称）”字段执行任意代码。 要求： Microweber 版本 = 2.0.9 管理员访问权限 复现步骤： 1. 使用管理员权限对应用程序进行身份验证 2. 访问端点 /admin/modules/newsletter/lists ，并点击 “+ 添加新列表” 3. 在 “列表名称” 字段中插入载荷 4. 点击 “保存” 以触发 JavaScript...
MAL-2026-15917 Malicious code in @crysnovax/baileys (npm)
@crysnovax/baileys is a renamed fork of the Baileys WhatsApp Web library. On every successful connection connection.update with connection === 'open', wired in lib/Socket/socket.js it silently makes the user's own authenticated WhatsApp account follow two channels controlled by the publisher,...
Malicious code in @systemzero/baileys (npm)
@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...
MAL-2026-15820 Malicious code in @systemzero/baileys (npm)
@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...
CVE-2026-82700
A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...
CVE-2026-82700
A cross-site scripting (XSS) vulnerability exists in the Newsletter Subscription component of code-projects Online Shopping System 1.0 , specifically in the file /offersmail.php . Manipulation of the email argument allows a remote, unauthenticated attacker to inject script, resulting in low impac...
EUVD-2026-68530
A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...
CVE-2026-78146
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...
EUVD-2026-66291
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...
CVE-2026-66596
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-66596
An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the WordPress Newsletter plugin in versions 9.3.3 and earlier . The flaw allows an unauthenticated attacker to inject and execute arbitrary scripts in the context of a victim's browser, requiring user interaction. The CVSS 3.1 ba...