PT-2024-31490 · Typo3 · Powermail

Name of the Vulnerable Software and Affected Versions: powermail extension versions prior to 7.5.0 powermail extension versions prior to 8.5.0 powermail extension versions prior to 10.9.0 powermail extension versions prior to 12.4.0 Description: An issue was discovered in the powermail extension...

TYPO3-EXT-SA-2024-006: Multiple vulnerabilities in "powermail" (powermail)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2024-006...

powermail extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

GHSA-RP53-FW29-RXG3 powermail extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the file upload functionality. An attacker can execute arbitrary code by uploading a file with a crafted extension and then accessing it through unspecified vectors. Remediation Upgrade in2code/powermail to...

TYPO3 powermail extension has unrestricted file upload vulnerability

Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors...

GHSA-2JQ7-PGQQ-GQQJ TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism

The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via unspecified vectors which allows an attacker to bypass the CAPTCHA protection mechanism. Remediation Upgrade in2code/powermail to version 2.0.11 or higher. References - Typo3 Advisory Credit: Jigal van Hemert...

TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism

The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors...

GHSA-M278-C6GG-4JRR TYPO3 powermail extension has unrestricted file upload vulnerability

Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors...

powermail extension for TYPO3 has Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-8CG3-JFJX-3PP2 powermail extension for TYPO3 has Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-MGW4-GV3F-G57J TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors

SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."...

TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors

SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."...

Cross-site scripting vulnerability in extension "Powermail" (powermail)

The extension uses \TYPO3\CMS\Core\Utility\GeneralUtility::removeXSS, which is known to be vulnerable to XSS...

campus-service.com XSS vulnerability

Open Bug Bounty ID: OBB-596295 Description| Value ---|--- Affected Website:| campus-service.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Typo3 Powermail Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

esterer.de XSS vulnerability

Open Bug Bounty ID: OBB-576227 Description| Value ---|--- Affected Website:| esterer.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Typo3 Powermail Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

wallstabe-schneider.de XSS vulnerability

Open Bug Bounty ID: OBB-573018 Description| Value ---|--- Affected Website:| wallstabe-schneider.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Typo3 Powermail Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Unrestricted File Upload

in2code/powermail is vulnerable a to unrestricted file upload vulnerability. By uploading files with an executable file extension, attackers are able to execute arbitrary code...

CAPTCHA Bypass

in2code/powermail is vulnerable CAPTCHA bypass. This is possible because the == operator is used to compare if the if code is set and equal to session value...