CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

EUVD-2026-53312

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71239: Improper Neutralization of Special Elements Used in a Template Engine

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

PT-2026-68105

Name of the Vulnerable Software and Affected Versions DjangoCRM affected versions not specified Description The massmail module fails to sanitize user-controlled EmlMessage fields, specifically subject and content, when rendering them through the Django Template constructor. This issue occurs in...

NexusPHP SQL Injection Vulnerability

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. SQL injection vulnerability in the massmail.php file in NexusPHP version 1.5. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

CVE-2017-12910

SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter...

MundiMail 0.8.2 - Remote Code Execution

MundiMail 0.8.2 - Remote Code Execution Reference: http://www.ccat.edu.mx/advisors/advisor5/advisor5.html Credits: Ccat Research Labs - México - Coatepec, Ver. www.ccat.edu.mx Software Link: http://sourceforge.net/projects/mundimail/ Tested on: Debian, Centos & Windows Server 2000 Preview: Code...