CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77136 Server-Side Template Injection in extension "powermail" (powermail)

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77136

CVE-2026-77136 is a Server-Side Template Injection (SSTI) in the TYPO3 Powermail extension. The raw value of a form field configured as the sender_name field is passed directly into a Fluid View as template source without sanitization. An unauthenticated attacker can submit arbitrary Fluid templa...

EUVD-2026-65340

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

TYPO3-EXT-SA-2026-022: Server-Side Template Injection in extension "powermail" (powermail)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022...

Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion

A directory traversal vulnerability in the givesight PowerMail Pro compowermail component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1532 info: name: Joomla!...

CVE-2010-0329

SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."...

EUVD-2008-2179

Malware in sbrugna...

EUVD-2010-3671

Malware in sbrugna...

EUVD-2010-1559

Malware in sbrugna...

EUVD-2010-3600

Malware in sbrugna...

EUVD-2014-3881

Malware in sbrugna...

EUVD-2012-5763

Malware in sbrugna...

EUVD-2010-3601

Malware in sbrugna...

EUVD-2010-0360

Malware in sbrugna...

EUVD-2010-4856

Malware in sbrugna...

EUVD-2024-2850

Malicious code in bioql PyPI...

EUVD-2025-22306

Malicious code in bioql PyPI...

CVE-2025-7899

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0...

Powermail extension for TYPO3 allows Insecure Direct Object Reference

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0...