Show filters
14 Total Results
Displaying 1-10 of 14
Sort by:
Attacker Value
Unknown
CVE-2012-2724
Disclosure Date: January 09, 2020 (last updated February 21, 2025)
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
0
Attacker Value
Unknown
CVE-2013-4447
Disclosure Date: November 01, 2013 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the API in the Simplenews module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an email address.
0
Attacker Value
Unknown
CVE-2012-5537
Disclosure Date: December 03, 2012 (last updated October 05, 2023)
The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.
0
Attacker Value
Unknown
CVE-2009-3783
Disclosure Date: October 26, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vector.
0
Attacker Value
Unknown
CVE-2009-3784
Disclosure Date: October 26, 2009 (last updated October 04, 2023)
Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
0
Attacker Value
Unknown
CVE-2009-3785
Disclosure Date: October 26, 2009 (last updated October 04, 2023)
Multiple cross-site request forgery (CSRF) vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.
0
Attacker Value
Unknown
CVE-2008-5996
Disclosure Date: January 28, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field.
0
Attacker Value
Unknown
CVE-2007-4872
Disclosure Date: September 27, 2007 (last updated October 04, 2023)
SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php, (3) admin/heading.php, or (4) evsearch.php; which reveals the path in various error messages.
0
Attacker Value
Unknown
CVE-2007-4873
Disclosure Date: September 27, 2007 (last updated October 04, 2023)
SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc.
0
Attacker Value
Unknown
CVE-2007-2598
Disclosure Date: May 11, 2007 (last updated October 04, 2023)
SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
0
