Advisories · Technology
Newsletters.
Every CVE that names Newsletters among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR
- Newsletters
- Broken access control
- CVSS 5.4 Medium
Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF
- Newsletters
- Cross-site request forgery (CSRF)
- CVSS 4.8 Medium
Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key
- Newsletters
- Weak cryptography or TLS
- CVSS 4.8 Medium
Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling
- Newsletters
- Authentication bypass
- CVSS 8.1 High
Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
- Newsletters
- Insecure deserialization
- CVSS 8.2 High
Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler
- Newsletters
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
- Newsletters
- Insecure deserialization
- CVSS 7.5 High
WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability
- Newsletters
- Information disclosure
- CVSS 7.2 High
Newsletter Lite < 4.9.3 - Admin+ Command Injection
- Newsletters