CVE-2024-47047

CVE-2024-47047 concerns the powermail TYPO3 extension (up to 12.4.0). The root cause is the failure to validate the mail parameter in the createAction, leading to an Insecure Direct Object Reference (IDOR). Consequence: an unauthenticated attacker can view user-submitted data from all forms persi...

CVE-2024-45232

Summary (CVE-2024-45232) : The powermail TYPO3 extension (up to 12.3.5) is vulnerable to an IDOR due to failure to validate the mail parameter in the confirmationAction. An unauthenticated attacker can display user-submitted form data stored in the database when the setting plugin.tx_powermail.se...

CVE-2024-45233

Powermail (TYPO3) up to version 12.3.5 is affected by Broken Access Control in the OutputController due to missing/insufficient access checks. An unauthenticated attacker can edit, update, delete, or export data of persisted forms when Powermail Frontend plugins are enabled. Fixed versions are 7....

CVE-2008-2182

CVE-2008-2182 is a cross-site scripting (XSS) vulnerability in the powermail TYPO3 extension, affecting versions prior to 1.1.10. The underlying issue is an input handling/vector exposure that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The publicly doc...