1683 matches found
Newsletter < 7.4.5 - Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
Newsletter < 7.6.9 - Cross-Site Scripting
The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...
Tautulli <= 2.16.1 - Path Traversal
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...
WordPress Email Newsletter - Reflected XSS
WordPress Email Newsletter plugin through 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to cra...
CVE-2026-28182
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
EUVD-2026-57961
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28182
CVE-2026-28182 describes a Subscriber Cross Site Scripting (XSS) vulnerability in the WordPress AcyMailing SMTP Newsletter plugin, affecting versions up to and including 10.11.1. The available documents confirm the vulnerability is XSS but do not provide details on the exact vulnerable component ...
CVE-2026-28182 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28182
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28181
CVE-2026-28181 concerns the WordPress AcyMailing SMTP Newsletter plugin, affected in versions up to 10.11.1. The issue is described as a Broken Access Control vulnerability, enabling unauthorized access to certain resources due to insufficient access restrictions. Based on the provided metrics, t...
CVE-2026-28181
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28181 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
EUVD-2026-57960
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
PT-2026-71527
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
PT-2026-71526
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
Malicious code in my-auto-follow (npm)
npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...
Malicious code in @dreamguyxeon/baileyx (npm)
npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches...
MAL-2026-13930 Malicious code in @dreamguyxeon/baileyx (npm)
npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches...
MAL-2026-13932 Malicious code in my-auto-follow (npm)
npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...