CVE-2026-109401

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'emailaddress' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail ro...

EUVD-2026-102800

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'emailaddress' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail ro...

CVE-2026-109401

The WP Mail Logging plugin for WordPress (versions up to and including 1.17.0 ) is vulnerable to Sensitive Information Exposure due to a LIKE wildcard flaw in the email_address parameter. An authenticated attacker with administrator-level access or higher can exploit this by initiating a personal...

CVE-2026-109401 WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'emailaddress' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail ro...

CVE-2026-103646 Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...

CVE-2026-103646

The Ultimate Multisite WordPress plugin (versions before 2.17.0 ) is vulnerable to an unauthenticated authentication bypass . The root cause is a discrepancy where the plugin's duplicate-account check normalizes an email address differently than the lookup used during customer creation. This allo...

CVE-2018-10097

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

CVE-2024-9799: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Profile Registration without Reload Refresh 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation of the argument...

CVE-2023-5612 Missing Authorization in GitLab

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled...

CVE-2019-17176

Genesys PureEngage Digital eServices 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp ActionColor, ClientNickNameColor, Email, email, or emailaddress parameter...

CVE-2018-10097

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

CVE-2018-10097

CVE-2018-10097 describes a cross-site scripting vulnerability in Domain Trader version 2.5.3, exploitable via the recoverlogin.php email_address parameter. The issue is a client-side/script injection flaw in that input parameter, enabling arbitrary script/HTML to be injected when processed by the...

CVE-2018-10097: Improper Neutralization of Input During Web Page Generation

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities

CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities Document Title: =============== CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1836 Release Date: ============= 2018-01-19...

CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities

Document Title: =============== CentOS Web Panel v0.9.8.12 - Multiple Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1836 Release Date: ============= 2018-01-19 Vulnerability Laboratory ID VL-ID:...

CVE-2017-15213: Improper Neutralization of Input During Web Page Generation

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the realname or emailaddress field to themes/CleanFS/templates/common.editallusers.tpl...

CVE-2017-15213

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the realname or emailaddress field to themes/CleanFS/templates/common.editallusers.tpl...

CVE-2008-6729: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that modify an account via the 1 password or 2 emailaddress parameter...