Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Sep 14, 2026An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.CVE-2023-50461 · Other software · TYPO3 · reported by MITREHigh 8.8
An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.
- Product
- direct_mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.CVE-2020-12700 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.CVE-2020-12699 · Other software · DKD · reported by MITREMedium 6.1
The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.CVE-2020-12698 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.CVE-2020-12697 · Other software · DKD · reported by MITREMedium 5.3
The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2019The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissioCVE-2019-16698 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.typo3.orgtypo3.org
Dec 29, 2017The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authenCVE-2013-7400 · Other software · DKD · reported by MITREHigh 7.5
The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comextensions.typo3.org
Dec 2, 2009Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlCVE-2009-4159 · Other software · Ivan Kartolo · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the FE address edit for tt_address & direct mail (dmaddredit) extension 0.4.0 and earlier for TYPO3 allows remote attackers to exCVE-2008-6458 · Other software · Dieter Mayer · reported by MITREHigh 7.5
SQL injection vulnerability in the FE address edit for tt_address & direct mail (dmaddredit) extension 0.4.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- FE Address Edit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 1999Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure defaultCVE-1999-1246 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions, allowing remote attackers to read the passwords and gain privileges.
- Product
- Site Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microsoft.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.