CVE-2024-45232

The powermail extension for TYPO3 (versions through 12.3.5) is vulnerable to an Insecure Direct Object Reference (IDOR) due to a failure to validate the mail parameter of the confirmationAction. An unauthenticated attacker can exploit this to view user-submitted data from all forms persisted by t...

CVE-2024-45233

Powermail (TYPO3) up to version 12.3.5 is affected by Broken Access Control in the OutputController due to missing/insufficient access checks. An unauthenticated attacker can edit, update, delete, or export data of persisted forms when Powermail Frontend plugins are enabled. Fixed versions are 7....

CVE-2008-2182

CVE-2008-2182 is a cross-site scripting (XSS) vulnerability in the powermail TYPO3 extension, affecting versions prior to 1.1.10. The underlying issue is an input handling/vector exposure that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The publicly doc...