Broken Access Control

in2code/powermail is vulnerable to Broken Access Control. The vulnerability is due to the lack of proper validation in the OutputController actions within the Powermail extension, allowing an unauthenticated attacker to edit, update, delete, or export data of persisted forms when the Powermail...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via unspecified vectors which allows an attacker to bypass the CAPTCHA protection mechanism. Remediation Upgrade in2code/powermail to version 2.0.11 or higher. References - Typo3 Advisory Credit: Jigal van Hemert...

Unrestricted File Upload

in2code/powermail is vulnerable a to unrestricted file upload vulnerability. By uploading files with an executable file extension, attackers are able to execute arbitrary code...

CAPTCHA Bypass

in2code/powermail is vulnerable CAPTCHA bypass. This is possible because the == operator is used to compare if the if code is set and equal to session value...