Design/Logic Flaw

An issue was discovered in the MailPoet Newsletters aka wysija-newsletters plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks...

CVE-2018-20853

Technical details for CVE-2018-20853 are not publicly available in the provided documents. Monitor for updates from vendor and security advisories.

CVE-2018-20853

An issue was discovered in the MailPoet Newsletters aka wysija-newsletters plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks...

Malicious PHP Script Infects 2,400 Websites in the Past Week

A botnet dubbed Brain Food is giving webmasters indigestion with related attacks that push bogus diet pills and IQ-boosting pills via web pages hosted on legitimate sites. So far, spammers have been successful, thanks to an effective Hypertext Preprocessor PHP script also called Brain Food that h...

Access Restriction Bypass

Moodle is vulnerable to access restriction bypass. Authenticated attackers can circumvent access restrictions and conduct spam attacks because moodle doesn't correctly check the contact list before the authorization of message transmissions...

CVE-2015-5331

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API...

Design/Logic Flaw

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API...

CVE-2015-5331

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API...

CVE-2015-5331

Moodle 2.9.x before 2.9.3 is affected: the messaging API flow fails to validate the contact list before authorizing message transmission, enabling remote authenticated users to bypass access controls and conduct spam via the messaging API. The issue is documented across multiple sources (NVD/NVD-...

CVE-2015-5331

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API...

CVE-2007-4494

The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks...

CVE-2007-4494

The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks...

Code injection

The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks...

CVE-2007-4494

The CVE-2007-4494 entry concerns eZ Publish: the tipafriend function in releases before 3.8.9 and before 3.9.3 does not restrict access for anonymous users, enabling remote spam attacks. The vulnerability is tied to insufficient access control rather than an explicit exploit described in the prov...

Crlf injection

CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the 1 Subject or 2 To parameter, as demonstrat...

CVE-2007-1718

CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the 1 Subject or 2 To parameter, as demonstrat...

CVE-2007-1718

CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the 1 Subject or 2 To parameter, as demonstrat...

CVE-2007-1718

CVE-2007-1718 is a CRLF injection vulnerability in PHP’s mail() function. The bug occurs when a subject or To header contains a control sequence after folding (notably a "\r\n\t\n"-like sequence) due to the SKIP_LONG_HEADER_SEP macro, allowing remote attackers to inject arbitrary email headers an...

CVE-2007-1179

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

CVE-2006-0114

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...