36 matches found
CVE-2026-47106: Improper Neutralization of Input During Web Page Generation
Ellucian Banner Self-Service before the April T2 release 2025-04-23 contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding...
CVE-2026-41141: Authorization Bypass Through User-Controlled Key
EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAddress parameter and resolves the owning entity Contact, Lead, Account, or User without performing an ACL check. An authenticated user with...
User Impersonation
Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to User...
CVE-2026-40872
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...
EUVD-2017-5646
Malware in sbrugna...
EUVD-2007-6142
Malware in sbrugna...
EUVD-2007-6483
Malware in sbrugna...
CVE-2023-41523
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php...
CVE-2023-41523
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php...
CVE-2023-41523
The Student Attendance Management System v1 is susceptible to a SQL injection vulnerability. The root cause is the incorrect manipulation of the emailAddress parameter within the createClassTeacher.php file. Exploitation of this flaw could allow unauthorized database interaction. To mitigate this...
CVE-2023-41523: Improper Neutralization of Special Elements used in an SQL Command
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php...
PT-2025-32291 · Unknown · Attendance Management System
Name of the Vulnerable Software and Affected Versions: Student Attendance Management System version 1 Description: The Student Attendance Management System is susceptible to a SQL injection issue through the emailAddress parameter at the createClassTeacher.php endpoint. Recommendations: As a...
CVE-2023-41523
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php...
Insightly: Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"
The vulnerability allowed bypassing email verification when creating a new Insightly account. The vulnerability existed in the "EmailAddress" parameter of the member creation endpoint. By modifying the parameter, an attacker could create a new account using any email address, including those of...
CVE-2024-8407: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in alwindoss akademy up to 35caccea888ed63d5489e211c99edff1f62efdba. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file cmd/akademy/handler/handlers.go. The manipulation of the argument emailAddress leads to cross...
CVE-2024-6869
CVE-2024-6869 : Falang multilanguage for WordPress is vulnerable up to version 1.3.52 due to missing capability checks, enabling authenticated attackers with Subscriber+ access to update/delete translations and expose the admin email. Wordfence/Red Hat notes indicate a patch is available; remedia...
CVE-2018-25035: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input as part of POST Request leads to cross site scripting...
Unescaped control characters in Gitblit
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext '[email protected]\n\trole = "admin"' value...
Privilege escalation
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'email protected\n\trole = "admin"' value...