Vulnerabilities

TI-2007-06008 CVE-2007-6301 · GHSA-vvrr-q8j7-w2fc

Cross-site scripting (XSS) vulnerability in compose.php in OpenNewsletter 2.5 and earlier…

LOW 24

Cross-site scripting (XSS) vulnerability in compose.php in OpenNewsletter 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0173 Published 2007-12-10 No fix listed CWE-79

TI-2006-06530 CVE-2006-6786 · GHSA-624v-9wf2-xxfc

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute…

LOW 33

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to (1) subscribe.php or (2) unsubscribe.php.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01882 Published 2006-12-28 No fix listed

TI-2006-06529 CVE-2006-6785 · GHSA-6xx8-6c67-fx9v

The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier…

MEDIUM 40

The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, or execute arbi…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04347 Published 2006-12-28 No fix listed

Vulnerabilities

Filters

Cross-site scripting (XSS) vulnerability in compose.php in OpenNewsletter 2.5 and earlier…

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute…

The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier…