Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,374 results · page 21 of 48

Jan 23, 2024Tuta is an encrypted email service.CVE-2024-23330 · Other software · tutao · reported by GitHubMedium 5.3
Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue.
Product
tutanota
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2024FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.CVE-2024-22819 · Other software · Flycms Project · reported by MITREHigh 8.8
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.
Product
Flycms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2024FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagteCVE-2024-22817 · Other software · Flycms Project · reported by MITREHigh 8.8
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
Product
Flycms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2024FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.CVE-2024-22549 · Other software · Flycms Project · reported by MITREMedium 5.4
FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.
Product
Flycms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 17, 2024IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules.CVE-2023-50950 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709.
Product
QRadar SIEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jan 17, 2024Sales Report Email for WooCommerce: Missing AuthorizationCVE-2022-38141 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8.
Product
Sales Report Email for WooCommerce
Affected
up to 2.8
What to do
Affects up to 2.8. Update Sales Report Email for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Contact Email Address parameCVE-2023-51725 · Other software · Hathway · reported by vdisclose@cert-in.org.inMedium 6.9
This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Contact Email Address parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system. Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.
Product
Skyworth Router CM5100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in cert-in.org.in
Jan 11, 2024Email Encoder – Protect Email Addresses and Phone Numbers: Stored Cross-Site ScriptingCVE-2023-7070 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eeb_mailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Encoder – Protect Email Addresses and Phone Numbers
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Email Encoder – Protect Email Addresses and Phone Numbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Unauthorized access of data and modification of dataCVE-2023-6875 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2024Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email GatewaCVE-2023-31488 · Network & remote access · Cisco · reported by MITRECritical 9.8
Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gateway, and various non-Cisco products, allow attackers to trigger a segmentation fault and execute arbitrary code via a crafted document.
Product
Ironport Email Security Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bst.cisco.com bst.cisco.com
Jan 9, 2024Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML CVE-2023-5770 · Other software · Proofpoint · reported by security@proofpoint.comMedium 5.3
Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.
Product
Proofpoint Enterprise Protection
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record proofpoint.com proofpoint.com
Jan 9, 2024A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1.CVE-2024-0344 · Other software · soxft · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250112.
Product
TimeMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Jan 8, 2024WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.
Product
WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Email Subscription Popup: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-6555 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Email Subscription Popup
Fixed in
1.2.20
What to do
Update Email Subscription Popup to 1.2.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 5, 2024Send Users Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52126 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3.
Product
Send Users Email
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Send Users Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Cross-Site Request Forgery (CSRF)CVE-2023-52119 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.
Product
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building
Affected
up to 3.1.18
What to do
Affects up to 3.1.18. Update Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 4, 2024OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.CVE-2023-3726 · Other software · OCSInventory · reported by help@fluidattacks.comMedium 6.9
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
Product
OCSInventory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com ocsinventory-ng.org
Jan 3, 2024Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information.CVE-2024-20807 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information.
Product
Samsung Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Stored Cross-Site ScriptingCVE-2023-7027 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Reflected Cross-Site ScriptingCVE-2023-6629 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 30, 2023IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.CVE-2023-52265 · Other software · Idurarapp · reported by MITREMedium 5.4
IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.
Product
Idurar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 29, 2023EnvíaloSimple: Email Marketing y Newsletters: Deserialization of Untrusted DataCVE-2023-51414 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.1
What to do
Affects up to 2.1. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023ZeroBounce Email Verification & Validation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51374 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZeroBounce ZeroBounce Email Verification & Validation allows Stored XSS.This issue affects ZeroBounce Email Verification & Validation: from n/a through 1.0.11.
Product
ZeroBounce Email Verification & Validation
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update ZeroBounce Email Verification & Validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51361 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS.This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.
Product
Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50857 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023WP Mail Log: Does not properly validate file extensions uploading files to attach to emailsCVE-2023-5673 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 25, 2023The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.CVE-2023-49954 · Other software · 3cx · reported by MITRECritical 9.8
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.
Product
3cx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve-2023-49954.github.io cve-2023-49954.github.io
Dec 21, 2023WordPress Email Marketing Plugin – WP Email Capture: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-28421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects WordPress Email Marketing Plugin – WP Email Capture: from n/a through 3.10.
Product
WordPress Email Marketing Plugin – WP Email Capture
Affected
up to 3.10
What to do
Affects up to 3.10. Update WordPress Email Marketing Plugin – WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023 A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.CVE-2023-6784 · Other software · Progress Software Corporation · reported by security@progress.comMedium 4.7
A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.
Product
Sitefinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Dec 19, 2023The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time.CVE-2023-50761 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Dec 18, 2023Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Cross-Site Request Forgery (CSRF)CVE-2023-48769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Email Address Encoder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48765 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Till Krüss Email Address Encoder allows Stored XSS.This issue affects Email Address Encoder: from n/a through 1.0.22.
Product
Email Address Encoder
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Tutanota (Tuta Mail) is an encrypted email provider.CVE-2023-46116 · Other software · tutao · reported by GitHubCritical 9.3
Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
Product
tutanota
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL.CVE-2023-48382 · Other software · Softnext · reported by twcert@cert.org.twMedium 6.5
Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
Product
Mail SQR Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL.CVE-2023-48381 · Other software · Softnext · reported by twcert@cert.org.twMedium 6.5
Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
Product
Mail SQR Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function.CVE-2023-48380 · Other software · Softnext · reported by twcert@cert.org.twHigh 7.4
Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
Product
Mail SQR Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function.CVE-2023-48379 · Other software · Softnext · reported by twcert@cert.org.twMedium 5.3
Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
Product
Mail SQR Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Contact Form Email
Fixed in
1.3.44
What to do
Update Contact Form Email to 1.3.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 7, 2023A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parametCVE-2023-48823 · Other software · Mayurik · reported by MITRECritical 9.8
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login.
Product
Courier Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 7, 2023Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.CVE-2023-48205 · Other software · Jorani · reported by MITREMedium 5.3
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.
Product
Leave Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 6, 2023Vulnerability of unauthorized access to email attachments in the email module.CVE-2023-49243 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 6, 2023Email Subscription Popup: Reflected Cross-Site ScriptingCVE-2023-6527 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Email Subscription Popup
Affected
up to 1.2.18
What to do
Affects up to 1.2.18. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 30, 2023Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: from n/a through 1.25.9.
Product
Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
Affected
up to 1.25.9
What to do
Affects up to 1.25.9. Update Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email download link: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
Product
Email download link
Affected
up to 3.7
What to do
Affects up to 3.7. Update Email download link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email posts to subscribers: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-41735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.
Product
Email posts to subscribers
Affected
up to 6.2
What to do
Affects up to 6.2. Update Email posts to subscribers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation CVE-2023-6420 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esMedium 6.5
A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.
Product
Voovi Social Networking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parCVE-2023-6416 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
Product
Voovi Social Networking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Nov 30, 2023Decorator – WooCommerce Email Customizer: Cross-Site Request Forgery (CSRF)CVE-2023-48284 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7.
Product
Decorator – WooCommerce Email Customizer
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Decorator – WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023 A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than versionCVE-2021-36806 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 4.7
A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version 4.5.3.4.
Product
Sophos Email Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.sophos.com community.sophos.com
Nov 30, 2023Mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2023-49077 · Other software · mailcow · reported by GitHubHigh 8.3
Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11.
Product
mailcow-dockerized
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.