CVE-2018-19511

CVE-2018-19511 concerns Webgalamb 7.0 where wg7.php lacks CSRF protections, demonstrated by using wg7.php?options=1 to change the administrator password. The Red Hat and NVD/NVD-linked records corroborate a CSRF flaw affecting Webgalamb, with no explicit exploit details or patch/version fixes pro...

CVE-2018-19511

wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password...

CVE-2018-19510

Webgalamb is affected by CVE-2018-19510 where subscriber.php (Webgalamb up to version 7.0) is vulnerable to SQL injection via the Client-IP HTTP header. The issue originates from insufficient validation of externally supplied SQL statements in the database layer, enabling an attacker to influence...

CVE-2018-19509

wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars instead of using a templating engine with proper contextual encoding. Because it is possible to insert arbitrary strings into the database, any JavaScript could be executed by the administrator, leading to XSS...

CVE-2018-19509

CVE-2018-19509 affects Webgalamb 7.0 (wg7.php) where a templating engine with proper contextual encoding is not used, and htmlspecialchars() is used opportunistically. Root cause: insufficient contextual encoding, allowing insertion of arbitrary strings into the database, which could enable JavaS...

CVE-2018-19515

In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atmentsddd1xGz, or xlsbgimport query parameters, most of these methods become available to unauthenticated users...

CVE-2018-19515

CVE-2018-19515 affects Webgalamb up to version 7.0. The issue: system/ajax.php endpoints intended for admin use can be accessed by unauthenticated users via certain query parameters (e.g., bgsend, atment_sddd1xGz, xls_bgimport), enabling broad method exposure. This is described as an information-...

Webgalamb Information Disclosure / XSS / CSRF / SQL Injection

Summary ------- Vendor: E.N.S. Zrt www.ens.hu Product: Webgalamb www.webgalamb.hu, www.facebook.com/webgalamb Webgalamb is a commercial email marketing software for managing subscription lists and sending out bulk emails. It is not SaaS but a PHP based web application that is typically hosted nex...