Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
newsletter vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2018-18461
The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote malicious users to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.
Kibokolabs Arigato Autoresponder And Newsletter 2.5.1.7
9.1
CVSSv3
CVE-2022-47408
An issue exists in the fp_newsletter (aka Newsletter subscriber management) extension prior to 1.1.1, 1.2.0, 2.x prior to 2.1.2, 2.2.1 up to and including 2.4.0, and 3.x prior to 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.
Fp Newsletter Project Fp Newsletter
Fp Newsletter Project Fp Newsletter 1.2.0
8.8
CVSSv3
CVE-2023-47757
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Fo...
Aweber Aweber
8.8
CVSSv3
CVE-2023-47686
Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions.
Kibokolabs Arigato Autoresponder And Newsletter
8.8
CVSSv3
CVE-2023-0766
The Newsletter Popup WordPress plugin up to and including 1.2 does not have CSRF checks in some places, which could allow malicious users to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
Newsletter Popup Project Newsletter Popup
8.8
CVSSv3
CVE-2022-41134
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.
Optinly Optinly
8.8
CVSSv3
CVE-2020-35932
Insecure Deserialization in the Newsletter plugin prior to 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exp...
Tribulant Newsletter
8.8
CVSSv3
CVE-2019-8127
A SQL injection vulnerability exists in Magento 2.2 before 2.2.10, Magento 2.3 before 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively pe...
Magento Magento
Magento Magento 2.3.2
8.8
CVSSv3
CVE-2015-9496
The freshmail-newsletter plugin prior to 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.
Freshmail Freshmail-newsletter
8.8
CVSSv3
CVE-2017-18523
The eelv-newsletter plugin prior to 4.6.1 for WordPress has CSRF in the address book.
Eelv Newsletter Project Eelv Newsletter
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367
CVE-2024-3611
CVE-2024-4947
CVE-2024-32988
CVE-2020-35165
local file inclusion
CVE-2024-4980
bypass
malicious code
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »