Advisories · Technology
plunk.
Every CVE that names plunk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Plunk: Stored XSS in campaign view
- plunk
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
Plunk: SNS webhook forgery
- plunk
- Weak cryptography or TLS
- CVSS 8.5 High
Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers
- plunk
- Other injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns
- plunk
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload
- plunk
- Cross-site scripting (XSS)