PT-2026-57599

Summary An authenticated customer can read other customers' allowed sender aliases from Froxlor's sender-delete confirmation page when mail.enable allow sender is enabled. customer email.php loads allowed sender by global auto-increment senderid alone, so a customer can enumerate foreign sender...

CVE-2018-25411: Improper Neutralization of Special Elements used in an SQL Command

MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to email.php with crafted SQL payloads in the 'id' parameter to...

EUVD-2006-6461

Malware in sbrugna...

EUVD-2020-23649

Malware in sbrugna...

CVE-2020-36071

SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page...

WordPress RSVPMaker 9.3.2 SQL Injection

!/bin/bash Set the URL of the website running the vulnerable plugin url="http://example.com/wp-content/plugins/rsvpmaker/rsvpmaker-email.php" Set the number of columns in the query columns=5 response=$curl -s "$url" query=$echo "$response" | grep -oP 'FROM . WHERE .' payload="' UNION SELECT...

CVE-2020-36071

SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page...

Sql injection

SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page...

CVE-2020-36071: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page...

CVE-2022-1768: Improper Neutralization of Special Elements used in an SQL Command

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the /rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive...

WordPress plugin RSVPMaker has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

CodeIgniter arbitrary code execution

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...

CVE-2021-24704: Improper Neutralization of Special Elements used in an SQL Command

In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...

PT-2022-9452

Name of the Vulnerable Software and Affected Versions Orange Form WordPress plugin version 1.0 Description The issue concerns an unprepared SQL query with an unsanitized parameter $id in the process bulk action function, located in the "admin/orange-form-email.php" file. Although only admins can...

CVE-2021-25103

The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the urladdon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires...

CVE-2021-25103: Improper Neutralization of Input During Web Page Generation

The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the urladdon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires...

PT-2022-9658

Name of the Vulnerable Software and Affected Versions Translate WordPress with GTranslate WordPress plugin versions prior to 2.9.7 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the body parameter in the url addon/gtranslate-email.php file is not...

GTranslate < 2.9.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the body parameter in the urladdon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCESALT and NONCEKEY alert/XSS/" / var form1 =...

CVE-2021-38325

The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...

PT-2021-22043

Name of the Vulnerable Software and Affected Versions: User Activation Email WordPress plugin versions up to and including 1.3.0 Description: The issue allows attackers to inject arbitrary web scripts via Reflected Cross-Site Scripting. This is possible through the uae-key parameter found in the...