Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

in2code/powermail

10 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 1 critical, 3 high, 1 medium
Registry
Packagist

Advisories 10

  • CVE-2026-77136Critical 9.5

    Server-Side Template Injection in extension "powermail" (powermail)

    Affected: from 13.0.0, fixed in 13.2.1; from 11.0.0, fixed in 12.6.1; fixed in 10.9.3.

  • CVE-2025-7899Medium 6.0

    Insecure Direct Object Reference in extension "powermail" (powermail)

    Affected: from 12.0.0, through 12.5.2; from 12.0.0, fixed in 12.5.3; from 13.0.0, fixed in 13.0.1.

  • An issue was discovered in the powermail extension through 12.4.0 for TYPO3.

    Affected: fixed in 7.5.1; from 8.0.0, fixed in 8.5.1; from 9.0.0, fixed in 10.9.1; from 12.0.0, fixed in 12.4.1.

  • An issue was discovered in powermail extension through 12.3.5 for TYPO3.

    Affected: fixed in 7.5.0; from 8.0.0, fixed in 8.5.0; from 9.0.0, fixed in 10.9.0; from 11.0.0, fixed in 12.4.0.

  • An issue was discovered in powermail extension through 12.3.5 for TYPO3.

    Affected: from 11.0.0, fixed in 12.4.0; from 9.0.0, fixed in 10.9.0; from 8.0.0, fixed in 8.5.0; fixed in 7.5.0.

  • The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified…

    Affected: from 2.0.0, fixed in 2.0.11.

  • Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to…

    Affected: fixed in 1.6.11; from 2.0.0, fixed in 2.0.14.

  • Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web…

    Affected: fixed in 1.6.5.

  • SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL…

    Affected: fixed in 1.5.4.

  • SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL…

    Affected: fixed in 1.5.2.