Vulnerabilities
Summary — last 7 days
New vulnerabilities3,102▲ 66 vs. last week
Critical / high1,415▼ 124 vs. last week
New active exploitation (KEV)6▲ 1 vs. last week
Unscored (no CVSS)162▼ 10 vs. last week
11 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.9) | 0.30% | — | Onlineoptimisation WP Mailto LinksAI | 9/22/2025 | 6/17/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Online Optimisation WP Mailto Links wp-mailto-links allows Stored XSS.This issue affects WP Mailto Links: from n/a through <= 3.1.4. | |
| Modified | Medium (5.4) | 0.48% | — | Ironikus WP Mailto Links | 10/20/2023 | 6/17/2026 | The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers… | |
| Modified | High (7.5) | 1.8% | 💥 Exploit | Joomla!Joomla COM Mailto | 5/1/2009 | 6/16/2026 | SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php. NOTE: SecurityFocus states that this issue has been disputed by the vendor. | |
| Modified | Medium (5) | 1.5% | — | Joomla COM Mailto | 9/18/2008 | 6/16/2026 | The mailto (aka com_mailto) component in Joomla! 1.5 before 1.5.7 sends e-mail messages without validating the URL, which allows remote attackers to transmit spam. | |
| Modified | High (7.5) | 3.6% | — | Perl-mailtools | 11/12/2002 | 6/16/2026 | The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer, which allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx. | |
| Modified | High (7.5) | 2.7% | — | Cgiscript.net Csmailto | 8/12/2002 | 6/16/2026 | CGIscript.net csMailto.cgi program allows remote attackers to use csMailto as a "spam proxy" and send mail to arbitrary users via modified (1) form-to, (2) form-from, and (3) form-results parameters. | |
| Modified | Medium (5) | 2.1% | — | Cgiscript.net Csmailto | 8/12/2002 | 6/16/2026 | CGIscript.net csMailto.cgi program allows remote attackers to read arbitrary files by specifying the target filename in the form-attachment field. | |
| Modified | High (7.5) | 11% | 💥 Exploit | Cgiscript.net Csmailto | 8/12/2002 | 6/16/2026 | CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field. | |
| Modified | Medium (5) | 2.0% | — | Cgiscript.net Csmailto | 8/12/2002 | 6/16/2026 | CGIscript.net csMailto.cgi program exports feedback to a file that is accessible from the web document root, which could allow remote attackers to obtain sensitive information by directly accessing the file. | |
| Modified | High (7.5) | 5.6% | 💥 Exploit | Brian Dorricott Mailto | 12/11/2001 | 6/16/2026 | mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, email, server, subject, and resulturl hidden form fields. | |
| Modified | High (7.5) | 2.2% | — | Ranson Johnson Mailto CGI Script | 11/14/2000 | 6/16/2026 | The mailto CGI script allows remote attacker to execute arbitrary commands via shell metacharacters in the emailadd form field. |