PT-2025-48234

The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2025-48262

Name of the Vulnerable Software and Affected Versions pretix affected versions not specified Description The software allows the use of placeholders in email templates that are populated with customer data, such as the attendee's name. If a customer's name contains HTML or Markdown formatting, th...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from insufficient team email address cleanup, which could lead to information disclosure. The following versions are affected: version 11.0.2 an...

CVE-2025-12414

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgrad...

When Your $2M Security Detection Fails: Can your SOC Save You?

Enterprises today are expected to have at least 6-8 detection tools, as detection is considered a standard investment and the first line of defense. Yet security leaders struggle to justify dedicating resources further down the alert lifecycle to their superiors. As a result, most organizations'...

CLSA-2025-1764152160 squid: Fix of CVE-2025-62168

CVE-2025-62168: fix failure to redact HTTP authentication credentials in error handling to prevent information disclosure - emailerrdata directive now defaults to 'off' for security previously 'on'...

CLSA-2025-1764151964 squid: Fix of CVE-2025-62168

CVE-2025-62168: fix failure to redact HTTP authentication credentials in error handling to prevent information disclosure - emailerrdata directive now defaults to 'off' for security previously 'on'...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

EUVD-2025-199647

An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the...

CVE-2025-51741

An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the...

EUVD-2025-199618

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

Malicious code in @vucod/email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91b5731b235151065b43287967fa368625822413bb181076f044b34a155d0c5 The package @vucod/email was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199374

Malicious code in @vucod/email npm...

MAL-2025-191388 Malicious code in @vucod/email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91b5731b235151065b43287967fa368625822413bb181076f044b34a155d0c5 The package @vucod/email was found to contain malicious code. Source: google-open-source-security...

CVE-2025-51741

CVE-2025-51741 affects Veal98 Echo Open-Source Community System versions 2.2–2.3. An unauthenticated attacker can trigger the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint, potentially causing a denial of service to the server or downstre...

CVE-2025-64062

The CVE (CVE-2025-64062) affects Primakon Pi Portal 1.0.18. The /api/V2/pp_users?email endpoint lacks proper server-side validation against the authenticated session, allowing an attacker to manipulate the email parameter to an arbitrary value (e.g., [email protected]) to hijack the session and ...

Semantic Superiority Vs. Forensic Efficiency: A Comparative Analysis of Deep Learning and Psycholinguistics for Business Email Compromise Detection

Business Email Compromise BEC is a sophisticated social engineering threat that manipulates organizational hierarchies and exploits psychological vulnerabilities, leading to significant financial damage. According to the 2024 FBI Internet Crime Report, BEC accounts for over $2.9 billion in annual...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...