Simplenews Security Vulnerabilities and Issues — Simplenews CVE List

Lucene search

SimplenewsSimplenews

4 matches found

CVE•added 2020/01/09 8:15 p.m.•56 views

CVE-2012-2724

The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.

5.3CVSS5.2AI score0.01383EPSS

CVE•added 2007/09/27 7:17 p.m.•42 views

CVE-2007-4872

SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php, (3) admin/heading.php, or (4) evsearch.php; which reveals the path in various error messages.

5CVSS6.2AI score0.00705EPSS

CVE•added 2007/05/11 10:19 a.m.•41 views

CVE-2007-2598

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter.

10CVSS8.4AI score0.0067EPSS

CVE•added 2007/09/27 7:17 p.m.•38 views

CVE-2007-4873

SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc.

5CVSS6.4AI score0.00475EPSS