Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Slack import functionality. An attacker can create verified user accounts with arbitrary email domains by submitting malicious import data to bypass email-based team access restrictions. Remediation Upgrade...

PT-2025-42443

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.10.x through 10.10.2 Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.11.x through 10.11.2 Description The software does not properly validate email ownership during a Slack import process. This allows...

EUVD-2002-1611

Malware in sbrugna...

EUVD-2022-15811

Malicious code in bioql PyPI...

EUVD-2025-27936

Malicious code in bioql PyPI...

CommuniGate Pro Authentication Bypass

The vulnerability of the CommuniGate Pro mail server lies in the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to send emails with arbitrary content to any email address...

Blitz Identity Provider Access Right Misconfiguration

The vulnerability of the Blitz Identity Provider software is related to incorrect configuration of access rights. Exploiting this vulnerability could allow a malicious actor to send an email with arbitrary text to the user’s associated account...

CVE-2025-3863

The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the processwbelpspromoform function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-4787

The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to insufficient limitations on the email recipient and the content in the 'sendpdf' and the 'sendpdffront' functions which are reachable via...

CVE-2023-5314

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal...

CVE-2020-9455

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users with minimal privileges to send arbitrary emails on behalf of the site via classrmuserservices.php sendemailuserview...

WordPress plugin WP Job Portal has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails

Impact Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious...

CVE-2024-7622

The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the aajaxQuickEmailTestCallback function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-5607

The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers,...

WordPress Customer Reviews for WooCommerce plugin <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Email Sending vulnerability discovered by Thura Moe Myint mgthuramoemyint in WordPress Plugin Customer Reviews for WooCommerce versions = 5.46.0...

Bricksforge < 2.1.1 - Missing Authorization to Unauthenticated Arbitrary Email Sending

Description The Bricksforge plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the a function in versions up to, and including, 2.0.17. This makes it possible for unauthenticated attackers to send arbitrary emails...

Grafana Monitoring Bypass Security Restrictions

The vulnerability of the Grafana monitoring and observation platform lies in the fact that users can register with any username or email address they choose. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...

CVE-2024-1044

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitreview' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with...

Design/Logic Flaw

phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a...