CVE-2017-14322

Interspire Email Marketer (IEM) prior to version 6.1.6 contains a vulnerability in the init.php login-status check that allows remote authentication bypass. By supplying a crafted value for the IEM_CookieLogin cookie, an attacker can obtain administrative access without valid credentials. Documen...

CVE-2018-19550

Interspire Email Marketer up to v6.1.6 is affected: the surveys_submit.php operation for creating/submitting surveys allows arbitrary file uploads, resulting in a PHP file being accessible under admin/temp/surveys/. Public exploit details (e.g., PacketStorm) demonstrate remote code execution via ...

CVE-2022-44790

CVE-2022-44790 concerns Interspire Email Marketer (up to version 6.5.1) where the vulnerability is a SQL Injection in the surveys module . An unauthenticated attacker could extract potentially sensitive data from the database if the survey ID exists. The root cause is improper input handling lead...

CVE-2022-40777

Interspire Email Marketer 6.5.0 and earlier allow arbitrary file uploads via surveys_submit.php (create survey and submit survey), enabling PHP files to be placed under admin/temp/surveys/. This CVE (CVE-2022-40777) links to an incomplete fix of CVE-2018-19550 and is supported by older advisories...

CVE-2018-19552

Interspire Email Marketer up to version 6.1.6 is affected by a SQL Injection in the Dynamiccontenttags.php file through the deleteblock blockid[] parameter. The root cause is improper handling of user-supplied input enabling unauthorized SQL command execution, with impact on confidentiality, inte...

CVE-2018-19651

CVE-2018-19651 affects Interspire Email Marketer up to version 6.1.6. The issue is a Server-Side Request Forgery (SSRF) in admin/functions/remote.php triggered by a what=importurl&url= parameter, enabling requests to arbitrary http/https URLs and, per reports, local-file access via file: URLs. Re...

CVE-2018-19549

Interspire Email Marketer up to version 6.1.6 is affected by a SQL Injection via the tagids Delete action in Dynamiccontenttags.php. Root cause is improper handling of tagids in the delete-tags flow, enabling arbitrary SQL execution with partial/high impact to confidentiality, integrity, and avai...

CVE-2018-19551

CVE-2018-19551 affects Interspire Email Marketer up to version 6.1.6, where a SQL injection exists in the checkduplicatetags tagname request handled by Dynamiccontenttags.php. The root cause is unsafe handling of input leading to arbitrary SQL execution by a remote attacker. The impact described ...

CVE-2018-19553

Summary (CVE-2018-19553): Interspire Email Marketer up to version 6.1.6 is affected by an SQL Injection in the Dynamiccontenttags.php file, triggered by an updateblock sortorder request. The root cause is unsafely handled input in that function, allowing a remote attacker to inject and execute SQ...