CVE-2026-100876

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the atta...

CVE-2026-100876 mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the atta...

CVE-2026-100876

A vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be ) due to missing authentication in an unknown function of the loginlinkstudent.php file. By manipulating the umail argument, an attacker can bypass authentication. Remote e...

CVE-2026-100876 mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the atta...

EUVD-2026-88012

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the atta...

PT-2026-99695

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description An issue exists in the file loginlinkstudent.php where manipulating the umail argument allows for missing authentication. This flaw...

CVE-2026-100876: Missing Authentication for Critical Function

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the atta...

CVE-2018-18783

XSS was discovered in SEMCMS V3.4 via the semcmsremail.php?type=ok umail parameter...

Cross site scripting

XSS was discovered in SEMCMS V3.4 via the semcmsremail.php?type=ok umail parameter...

PT-2018-14647

Name of the Vulnerable Software and Affected Versions SEMCMS version 3.4 Description A cross-site scripting XSS issue was found in SEMCMS. The issue is related to the umail parameter in the semcms remail.php endpoint, specifically when type=ok. Recommendations For SEMCMS version 3.4, consider...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01726)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A cross-site scripting vulnerability exists in SEMCMS version 3.4, which can be exploited by remote attackers to inject arbitrary Web script or HTML by sending the 'umail' parameter to the...

CVE-2018-18783: Improper Neutralization of Input During Web Page Generation

XSS was discovered in SEMCMS V3.4 via the semcmsremail.php?type=ok umail parameter...

U-Mail邮件系统二次注入2（无需登录，可批量直接获取管理员密码）

简要描述： 声明:不是故意刷漏洞，只是每天打完LOL后分析下，找到一个提交一个，见谅。我卡牌玩的还是很6的。: 详细说明： 漏洞文件/fast/oab/module/operates.php代码 与上一个二次注入缺陷原理都一样，这次是另一个文件，是无需登录的 if ACTION == "save-to-pab" includeonce LIBPATH."PAB.php" ; $PAB = PAB::getinstance ; $maillistid = trim $GET'maillist' ; if $maillistid ...... else $userids = trim...

Umail最新版2处SQL注入漏洞可遍历数据库(续三)

简要描述： 大牛们都去挖cmseasy了，我却还在挖umail。 详细说明： Sqli 1：\client\mail\module\omail.php Line：559 if ACTION == "mail-send" ... if !$attachlist $attachlist = array ; if $FILES ... $netdiskfilesid = gss $POST'ndselectfile' ; $ndsendfilesid = gss $POST'ndsendfile' ; if $ndsendfilesid && $netdiskfilesid...

Umail最新版SQL注入(续)

简要描述： 看到路人甲大神频频发威，..... 详细说明： File: client\pab\module\ocontact.php Line: 371 if ACTION == "contact-del" $contactids = gss $POST'contactids' ; // 未过滤 if !$contactids dumpjson array "status" = TRUE, "message" = "" ; $result = $PAB-delContactByID $userid, $contactids, 0 ;//跟踪该方法 if $result dumpjson...

Umail最新版本sql注入漏洞

简要描述： 服务器的企业和政府应该挺多的， 在官网看了下，客户有中国电信、中国人民银行、外交部等等，希望尽快通知厂商处理吧 详细说明： 漏洞exp: http://xxxx/webmail/fileshare.php?inmail=1&file=MScgdW5pb24gc2VsZWN0IDEsMiwzLDQsKHNlbGVjdCBwYXNzd29yZCBmcm9tIHdlYl91c3Igd2hlcmUgdXNyX25hbWU9J2FkbWluJyksNiw3LDgsOSwxMCwxMSwxMiwxMywxNCM= （flie的内容为注射语句的base64加密，无视GPC）...