523 matches found
PT-2026-95190
Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.11 Description Unauthenticated attackers can redirect password recovery tokens to domains under their control. This occurs because the software constructs password-reset links using the client-supplied Origin header...
SOGo Null Pointer DoS
The vulnerability of the Alinto SOPE framework and the SOGo software for collaborative work is related to the handling of a zero pointer. Exploiting this vulnerability could allow an attacker to cause service failures...
CVE-2026-14835
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...
CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...
CVE-2026-14835
The SOGO Add Script to Individual Pages Header Footer WordPress plugin (versions prior to 4.0 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox and does not restrict these actions ...
EUVD-2026-68154
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...
WordPress SOGO Add Script to Individual Pages Header Footer plugin <= 3.9 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin SOGO Add Script to Individual Pages Header Footer versions = 3.9...
CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...
PT-2026-83523
Name of the Vulnerable Software and Affected Versions SOGO Add Script to Individual Pages Header Footer versions prior to 4.0 Description The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox. Additionally, it does not restrict these actions to...
CVE-2026-14835: Improper Neutralization of Input During Web Page Generation
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...
SOGo SQL Injection
The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...
SOGo SQL Injection
The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...
SOGo Server Confidential Data Access
The vulnerability of the SOGo collaborative software server relates to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of the data...
SOGo SQL Injection
The vulnerability of the management server’s software for collaborative work, SOGo, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...
SOGo Detect
This template will detect a running SOGo instance !/usr/bin/env python3 -- coding: utf-8 -- """This template will detect a running SOGo instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SOGo Detect',...
VulnCheck KEV: CVE-2026-8496
A cross-site scripting XSS vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS...
Linux Distros Unpatched Vulnerability : CVE-2026-39178
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the...
Linux Distros Unpatched Vulnerability : CVE-2026-39179
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password...