Superman_04

**Name of the Vulnerable Software and Affected Versions** mettle sendportal versions prior to 3.0.2 **Description** A flaw in the Campaign Creation Endpoint within the file `vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php` allows for a remote authorization bypass through manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mettle sendportal versions prior to 3.0.2 **Description** An issue in the APIv1 Webhooks component allows remote attackers to bypass authentication. This occurs within the `sendgrid/postmark/postal/mailjet` functions, where improper manipulation leads to missing authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `sendgrid/postmark/postal/mailjet` functions within the APIv1 Webhooks component.

**Name of the Vulnerable Software and Affected Versions** Mettle sendportal versions prior to 3.0.2 **Description** A cross site scripting issue exists in the Campaign Handler component within the `/webview/` file. A remote attacker can trigger this by manipulating the `content` argument. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.