EUVD-2026-102507

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367: Use of Default Cryptographic Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

PT-2026-115307

Name of the Vulnerable Software and Affected Versions BillionMail versions prior to 5.0 Description An issue exists where a hard-coded cryptographic key allows unauthenticated attackers to forge JSON Web Tokens JWTs by calculating the key from provided configuration constants. Attackers can use...

neoartists.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-559051 Description| Value ---|--- Affected Website:| neoartists.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...