Useplunk
Monthly
Amazon SNS webhook spoofing in Plunk before 0.9.0 lets any unauthenticated remote attacker forge notifications to the /webhooks/sns endpoint because the server never validates the SNS signature, certificate, or topic ARN. Attackers can inject fake email-delivery events to trigger workflow automations, unsubscribe contacts, poison delivery metrics, and drive up AWS SES billing costs. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially automatable against default deployments.
CRLF injection in Plunk email platform's SESService.ts allows authenticated API users to inject arbitrary MIME headers by embedding carriage return/line feed sequences in user-controlled fields (from.name, subject, custom headers, attachment filenames). Attackers can silently add Bcc headers for email forwarding, manipulate Reply-To addresses, or spoof senders by exploiting the lack of input sanitization before MIME message construction. CVSS 8.5 severity reflects network-accessible exploitation with low complexity requiring only low-privilege authentication. No public exploit identified at time of analysis, with EPSS data unavailable for this 2026 CVE identifier. Vendor-released patch: version 0.8.0 implements schema-level validation rejecting CR/LF characters.
SSRF in Plunk email platform before 0.7.0.
Stored XSS in Plunk's campaign management feature allows authenticated project members with lower privileges to inject malicious scripts into email body content that subsequently executes in the browser session of any admin or peer member who views the campaign in the admin dashboard. The root cause is React's `dangerouslySetInnerHTML` API rendering unsanitized user-supplied HTML, bypassing React's built-in XSS protections. No active exploitation is confirmed (not in CISA KEV, EPSS at 0.03%), and a vendor-released patch exists in v0.9.0 integrating DOMPurify; however, the insider privilege-escalation threat model - member to admin - makes patching a meaningful priority for multi-user deployments.
Plunk is an open-source email platform built on top of AWS SES. versions up to 0.7.1 is affected by cross-site scripting (xss) (CVSS 5.4).
Amazon SNS webhook spoofing in Plunk before 0.9.0 lets any unauthenticated remote attacker forge notifications to the /webhooks/sns endpoint because the server never validates the SNS signature, certificate, or topic ARN. Attackers can inject fake email-delivery events to trigger workflow automations, unsubscribe contacts, poison delivery metrics, and drive up AWS SES billing costs. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially automatable against default deployments.
CRLF injection in Plunk email platform's SESService.ts allows authenticated API users to inject arbitrary MIME headers by embedding carriage return/line feed sequences in user-controlled fields (from.name, subject, custom headers, attachment filenames). Attackers can silently add Bcc headers for email forwarding, manipulate Reply-To addresses, or spoof senders by exploiting the lack of input sanitization before MIME message construction. CVSS 8.5 severity reflects network-accessible exploitation with low complexity requiring only low-privilege authentication. No public exploit identified at time of analysis, with EPSS data unavailable for this 2026 CVE identifier. Vendor-released patch: version 0.8.0 implements schema-level validation rejecting CR/LF characters.
SSRF in Plunk email platform before 0.7.0.
Stored XSS in Plunk's campaign management feature allows authenticated project members with lower privileges to inject malicious scripts into email body content that subsequently executes in the browser session of any admin or peer member who views the campaign in the admin dashboard. The root cause is React's `dangerouslySetInnerHTML` API rendering unsanitized user-supplied HTML, bypassing React's built-in XSS protections. No active exploitation is confirmed (not in CISA KEV, EPSS at 0.03%), and a vendor-released patch exists in v0.9.0 integrating DOMPurify; however, the insider privilege-escalation threat model - member to admin - makes patching a meaningful priority for multi-user deployments.
Plunk is an open-source email platform built on top of AWS SES. versions up to 0.7.1 is affected by cross-site scripting (xss) (CVSS 5.4).