26 matches found
CVE-2026-92455
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...
CVE-2026-92455 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...
CVE-2026-92455 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...
EUVD-2026-80660
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...
CVE-2026-92455: Missing Authorization
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...
CVE-2026-15673: Improper Neutralization of Special Elements used in an SQL Command
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
EUVD-2024-52936
Malicious code in bioql PyPI...
CVE-2024-56038
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through = 1.2.9...
CVE-2024-56038
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through = 1.2.9...
CVE-2024-56038 WordPress SendSMS Plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through = 1.2.9...
CVE-2024-56038 WordPress SendSMS Plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SendSMS allows Reflected XSS.This issue affects SendSMS: from n/a through 1.2.9...
CVE-2024-56038
CVE-2024-56038 is a Reflected XSS in the WordPress plugin SendSMS. The vulnerability arises from improper input neutralization during dynamic web page generation, enabling reflection-based script execution. Affected software: SendSMS, version range reported as up to 1.2.9 (and not clearly bounded...
WordPress plugin SendSMS 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-56038: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through = 1.2.9...
WordPress SendSMS Plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin SendSMS versions = 1.2.9...
WordPress MoceanAPI SendSMS Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)
Software MoceanAPI SendSMS Type Plugin Vulnerable versions = 1.4.11 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fcacb7942fc9 Credits Rafie Muhammad Patchstack...
Malicious Package
Overview yandex-sendsms is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...
CVE-2019-12358
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dlsendsms.php when the attacker has dlsprint authority via a dlid cookie...
PT-2018-18966 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in a "dl/dl sendsms.php" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "dl/dl sendsms.php" request until the issue is...
