71 matches found
CVE-2026-121551
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...
EUVD-2026-115896
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...
CVE-2026-121551
PostfixAdmin versions through 4.0.5 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises when authenticated mailbox users create a TOTP exception containing an unescaped description . If a global administrator views the totp-exceptions.php page, the injected script execute...
CVE-2026-121551 PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...
CVE-2026-121551 PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...
CVE-2026-121551: postfixadmin: PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users…
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...
CLEANSTART-2023-IH40235 AliasHandler component in PostfixAdmin before 3
Security vulnerability affects the postfixadmin package. The AliasHandler component in PostfixAdmin before 3...
USN-8242-2 postfixadmin vulnerability
USN-8242-1 fixed a vulnerability in CiviCRM. This update provides the corresponding fix for PostfixAdmin. Original advisory details: Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-si...
USN-8242-2: PostfixAdmin vulnerability
USN-8242-1 fixed a vulnerability in CiviCRM. This update provides the corresponding fix for PostfixAdmin. Original advisory details: Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-si...
EUVD-2012-0839
Malware in sbrugna...
CVE-2012-0812
PostfixAdmin 2.3.4 has multiple XSS vulnerabilities...
Postfixadmin Protected Alias Deletion
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postfixadmin Protected Alias Deletion Vulnerability', 'Description' = %q Postfixadmin installations between 2.91 and 3.0.1 do not check if an adm...
OPENSUSE-SU-2024:11182-1 postfixadmin-3.3.10-1.6 on GA media
These are all security issues fixed in the postfixadmin-3.3.10-1.6 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:10388-1 postfixadmin-3.0-1.1 on GA media
These are all security issues fixed in the postfixadmin-3.0-1.1 package on the GA media of openSUSE Tumbleweed...
Ubuntu: Security Advisory (USN-6550-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-6550-1 postfixadmin vulnerabilities
It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. CVE-2022-29221 It was discovered that Moment.js, that is...
USN-6550-1: PostfixAdmin vulnerabilities
It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. CVE-2022-29221 It was discovered that Moment.js, that is...
Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : PostfixAdmin vulnerabilities (USN-6550-1)
The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6550-1 advisory. It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generatin...
SUSE CVE-2012-0812
PostfixAdmin 2.3.4 has multiple XSS vulnerabilities...
SUSE CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...