CVE-2025-43920

CVE-2025-43920: Command Injection via Email Subject in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43920 Severity: 5.4 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Type: Remote Affected Software:...

CVE-2025-43919-POC

🚨 CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 cPanel/WHM A new vulnerability has been discovered in GNU Mailman 2.1.39, bundled with cPanel/WHM, allowing unauthenticated remote attackers to read arbitrary files on the server via a directory traversal flaw. 📌 Vulnerability Summary:...

CVE-2025-43919

CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43919 Severity: 5.8 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Attack Type: Remote Affected Software: GNU Mailman...

CVE-2025-43921

CVE-2025-43921: Unauthenticated Mailing List Creation in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43921 Severity: 5.3 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Type: Remote Affected Softwar...

mailman-web (0.0.5) potentially affected by CVE-2026-15307 via django (3.1.0rc1)

django PYPI version 3.1.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - mailman-web 0.0.5 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource Multiple Vulnerabilities (crlsa-2021_4826)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214826 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offlin...

Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource Multiple Vulnerabilities (crlsa-2021_1751)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211751 advisory. mailman: arbitrary content injection via the options login page CVE-2020-12108 mailman: arbitrary content injection via the private archive login page...

Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource (crlsa-2021_4916)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214916 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover CVE-2021-44227 Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093203)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093203 advisory. In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093164)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093164 advisory. /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Tenable has extracted the preceding description block directly from the Unity Linux...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093166)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093166 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrftoken value is not specific to a single user account. An attacker can obtain a value within th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093198)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093198 advisory. In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093193 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093169 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, and may be useful in conducting a...

OPENSUSE-SU-2026:11539-1 postorius-1.3.13-8.1 on GA media

These are all security issues fixed in the postorius-1.3.13-8.1 package on the GA media of openSUSE Tumbleweed...

mailman-web (0.0.5) potentially affected by CVE-2026-15307 via django (3.1.0rc1)

django PYPI version 3.1.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - mailman-web 0.0.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

mailman-web (0.0.5) potentially affected by CVE-2026-15830 via django (3.1.0rc1)

django PYPI version 3.1.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - mailman-web 0.0.5 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

mailman-web (0.0.5) potentially affected by CVE-2026-15830 via django (3.1.0rc1)

django PYPI version 3.1.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - mailman-web 0.0.5 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...