CVE-2025-43919-POC

🚨 CVE-2025-43919: Directory Traversal en GNU Mailman 2.1.39 cPanel/WHM Se ha descubierto una nueva vulnerabilidad en GNU Mailman 2.1.39, incluido con cPanel/WHM, que permite a atacantes remotos no autenticados leer archivos arbitrarios en el servidor a través de una falla de Directory Traversal. ...

CVE-2025-43920

CVE-2025-43920：GNU Mailman 2.1.39（cPanel/WHM 捆绑版）中通过邮件主题实施的命令注入 发现者： Firudin Davudzada 与 Musazada Aydan 公开日期： 2025年4月 CVE ID： CVE-2025-43920 严重性： 5.4 中等 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N 攻击类型： 远程 受影响软件： GNU Mailman 2.1.39（捆绑于 cPanel/WHM） 概述 GNU Mailman 2.1.39 在随 cPanel 和 WHM...

CVE-2025-43919

CVE-2025-43919: Directory Traversal en GNU Mailman 2.1.39 Paquete cPanel/WHM Descubierto por: Firudin Davudzada & Musazada Aydan Fecha de divulgación: Abril de 2025 CVE ID: CVE-2025-43919 Gravedad: 5.8 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Tipo de ataque: Remoto Software afectado: G...

CVE-2025-43921

CVE-2025-43921: GNU Mailman 2.1.39（cPanel/WHM 捆绑包）中未经身份验证的邮件列表创建 发现者： Firudin Davudzada & Musazada Aydan 披露日期： 2025年4月 CVE ID： CVE-2025-43921 严重性： 5.3 中等 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N 攻击类型： 远程 受影响软件： GNU Mailman 2.1.39（与 cPanel/WHM 捆绑） 概述 与 cPanel 和 WHM 捆绑的 GNU Mailman 2.1.39...

Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource Multiple Vulnerabilities (crlsa-2021_4826)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214826 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offlin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093198)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093198 advisory. In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093203)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093203 advisory. In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093193 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093164)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093164 advisory. /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Tenable has extracted the preceding description block directly from the Unity Linux...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093166)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093166 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrftoken value is not specific to a single user account. An attacker can obtain a value within th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093169 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, and may be useful in conducting a...

OPENSUSE-SU-2026:11539-1 postorius-1.3.13-8.1 on GA media

These are all security issues fixed in the postorius-1.3.13-8.1 package on the GA media of openSUSE Tumbleweed...

PYSEC-2026-658 Mailman Sensitive Information Disclosure

Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...

Mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the 1 email or 2 language parameters...

PYSEC-2026-659 mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...

PYSEC-2026-657 Mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the 1 email or 2 language parameters...

PYSEC-2026-660 Cross Site Request Forgery in mailman

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...

PYSEC-2026-661 Moderate severity vulnerability that affects mailman

An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...