Open Newsletter: >> Open Newsletter >> 2.0 Security Vulnerabilities
The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, or execute arbitrary code in conjunction with another vulnerability.
CVSS Score
7.5
EPSS Score
0.094
Published
2006-12-28
Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to (1) subscribe.php or (2) unsubscribe.php.
CVSS Score
6.5
EPSS Score
0.023
Published
2006-12-28