CVE-2026-129169

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message,...

CVE-2026-129169

PMail versions 2.5.0 through 2.9.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability via the /api/email/send endpoint. The root cause is the processing of unsanitized HTML in the email body, which allows authenticated users to inject malicious scripts. These scripts can execute ...

EUVD-2026-125598

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message,...

CVE-2026-129169 PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message,...

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

CVE-2026-11357 Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress (versions up to and including 3.7.5) contains a Sensitive Information Exposure flaw in editor_assets_variables. Authenticated attackers with contributor-level access can extract license key, license owner email, a...

WGDashboard-v4.3.2-SSTI-to-Root-RCE-PoC

WGDashboard SSTI to Root RCE PoC | WGDashboard Proof of conce...

CVE-2023-52265: Improper Neutralization of Input During Web Page Generation

IDURAR aka idurar-erp-crm through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data...

Default credentials

An issue was discovered in Deskpro before 2019.8.0. The /api/emailaccounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to...

PT-2020-12626

Name of the Vulnerable Software and Affected Versions Deskpro versions prior to 2019.8.0 Description An issue was discovered where the "/api/email accounts" endpoint failed to properly validate a user's privilege. This allowed an attacker to retrieve cleartext credentials of all helpdesk email...