15 matches found
CVE-2026-109169 LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...
EUVD-2026-90515
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
CVE-2026-90972: Improper Access Control
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
HGiga C&Cm@il Access Control Vulnerability
HGiga C&Cm@il is an email collaboration system developed by China’s HGiga Corporation. There is an access control vulnerability in HGiga C&Cm@il, which stems from the lack of authentication. This vulnerability could allow unverified remote attackers to read and modify the email content of any use...
EUVD-2025-28710
Malicious code in bioql PyPI...
Unspecified Vulnerability in Citadel WebCit
WebCit is the Citadel Servlet engine. A security vulnerability exists in Citadel WebCit 926 and earlier versions. A remote authentication attacker can exploit this vulnerability to read someone's email via the msgconfirmmove template...
PT-2020-7259
Name of the Vulnerable Software and Affected Versions: Basic webmail module versions 6.x-1.x before 6.x-1.2 Description: The issue allows remote authenticated users with the access basic webmail permission to read arbitrary users' email addresses. Recommendations: For Basic webmail module version...
PT-2017-13155
Name of the Vulnerable Software and Affected Versions iOS versions prior to 11.2 macOS versions prior to 10.13.2 Description The issue involves the Mail Drafts component and allows man-in-the-middle attackers to read e-mail content by leveraging mishandling of S/MIME credential encryption...
paid-to-read-email.com XSS vulnerability
Open Bug Bounty ID: OBB-441688 Description| Value ---|--- Affected Website:| paid-to-read-email.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...
Android Vulnerability Bypasses App's Digital Signature
A vulnerability exists in the Android code base that would allow a hacker to modify a legitimate, digitally signed Android application package file APK and not break the app’s cryptographic signature—an action that would normally set off a red flag that something is amiss. Researchers at startup...
CVE-2006-2917: Undefined Security Weakness
Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the 1 CREATE, 2 SELECT, 3 DELETE, ...
CVE-2003-1080: Undefined Security Weakness
Unknown vulnerability in mail for Solaris 2.6 through 9 allows local users to read the email of other users...
CVE-2000-0318: Undefined Security Weakness
Atrium Mercur Mail Server 3.2 allows local attackers to read other user's email and create arbitrary files via a dot dot .. attack...
