CVE-2026-91833

The WX Subscribe 微信支付付费订阅 WordPress plugin (versions up to and including 1.2.1 ) is vulnerable to an unauthenticated SQL injection attack. The flaw occurs because the plugin fails to properly sanitize and escape a parameter before utilizing it in a SQL statement. This vulnerability specifically a...

Path Traversal

nukeviet/nukeviet is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the attach parameter in the administrator Edit Comment function, which allows an authenticated administrator to traverse directories and delete arbitrary files within the application root...

CVE-2026-54065

Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., "config.php" by injecting a crafted "attach" parameter, rendering the application inoperable...

Directory Traversal

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Directory Traversal via the attach parameter in the comment editing process. An attacker can cause arbitrary file deletion by injecting a crafted value that leverages path...

EUVD-2020-17612

Malware in sbrugna...

Medium: evolution

Issue Overview: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to th...

DEBIAN-CVE-2020-24904

An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link...

Information disclosure

An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link...

UBUNTU-CVE-2020-24904

An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link...

CVE-2020-24904: Undefined Security Weakness

An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link...

GNOME Gmail Security Vulnerability

GNOME Gmail is a Linux desktop mailer by the individual developer David Steele. A security vulnerability exists in GNOME Gmail version 2.5.4, which stems from a problem found in the attach parameter that allows remote attackers to obtain sensitive information via a crafted mailto link...

CVE-2020-24904

Removed by vendor...

SUSE CVE-2020-11880

An issue was discovered in KDE KMail before 19.12.3. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an...

CVE-2021-39420

Multiple Cross Site Scripting XSS vulnerabilities exist in VFront 0.99.5 via the 1 s parameter in searchall.php and the 2 msg parameter in add.attach.php...

Cross site scripting

Multiple Cross Site Scripting XSS vulnerabilities exist in VFront 0.99.5 via the 1 s parameter in searchall.php and the 2 msg parameter in add.attach.php...

DEBIAN-CVE-2020-11880

An issue was discovered in KDE KMail before 19.12.3. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an...

PT-2020-12913 · Gnome +2 · Gnome Evolution +2

Name of the Vulnerable Software and Affected Versions: GNOME Evolution versions prior to 3.35.91 Description: An issue was discovered where a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to the...

CVE-2014-100002: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...

PT-2015-3608

Name of the Vulnerable Software and Affected Versions ManageEngine SupportCenter Plus versions 7.9 through 7917 Description A directory traversal issue allows remote attackers to read arbitrary files by using a ..%2f dot dot encoded slash in the attach parameter to "WorkOrder.do" in the file...

Apple iCal ATTACH参数拒绝服务漏洞

BUGTRAQ ID: 28633 CVECAN ID: CVE-2008-2007 iCal是Mac OS X操作系统中所捆绑的个人日历程序。 iCal在处理畸形格式的ICS文件时存在漏洞，可能导致应用程序处理时崩溃。 如果用户受骗打开的.ics文件包含有以下行的话： /----------- ATTACH;VALUE=URI:S=osumi - -----------/ iCal在导入.ics文件后试图使用ATTACH值时会出现错误的资源释放，导致应用程序崩溃。 Apple iCal 3.0.1 Apple -----...