114 matches found
malware-ioc
Lucid The Lucid Phishing-as-a-Service PhAAS platform, developed by the XinXin group, facilitates large-scale phishing campaigns targeting global organizations, including postal and courier services. Utilizing advanced technologies like RCS and iMessage, the group employs automated tools and evasi...
npm: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
npm: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words vulnerability discovered by ? in WordPress npm postal-mime versions = 3.0.0, 4.0.8...
GHSA-F2HQ-32VH-53CC postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined s...
@3sixty/mailbox-connector-gmail (0.20.0-next.0), @3sixty/mailbox-connector-imap (0.20.0-next.0) +111 more potentially affected by unknown CVE via postal-mime (>=3.0.0, <=4.0.7)
postal-mime NPM version =3.0.0, =3.0.2, =0.1.0, =0.16.0, =0.13.1, =0.13.1, =0.13.1, =0.13.1, =0.13.1, =0.17.0 and more Source cves: unknown CVE Source advisory: GHSA-F2HQ-32VH-53CC...
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined s...
@3sixty/mailbox-connector-gmail (0.20.0-next.0), @3sixty/mailbox-connector-imap (0.20.0-next.0) +111 more potentially affected by unknown CVE via postal-mime (>=3.0.0, <=4.0.7)
postal-mime NPM version =3.0.0, =3.0.2, =0.1.0, =0.16.0, =0.13.1, =0.13.1, =0.13.1, =0.13.1, =0.13.1, =0.17.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F2HQ-32VH-53CC...
PT-2026-67990
Name of the Vulnerable Software and Affected Versions DHL Shipping Germany for WooCommerce WordPress plugin versions prior to 4.0.1 Description An issue exists where the shipping-label storage directory is not protected by server-independent access control, relying exclusively on an Apache...
CVE-2026-14927
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...
Malicious code in @cashback/postal-premium (npm)
--- Credit: OpenSSF source...
CVE-2026-15192
A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhooks. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to...
EUVD-2026-42624
A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhooks. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to...
EUVD-2026-42509
The WP DSGVO Tools GDPR WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export including name, postal address, pho...
CVE-2026-11869 WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request
The WP DSGVO Tools GDPR WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export including name, postal address, pho...
Malicious code in @cashback/postal-premium (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7060 Malicious code in @cashback/postal-premium (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-25529
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be...
CVE-2026-25529
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be...
CVE-2026-25529 Postal has HTML injection / XSS in message view
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be...
EUVD-2026-11603
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be...
CVE-2026-25529 Postal has HTML injection / XSS in message view
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be...