CVE-2024-7472

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-93 CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-74736.5An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerab CVE-2024-74748.1In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external us CVE-2024-74759.1An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without autho CVE-2024-74764.3A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated att CVE-2024-74776.7A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbi CVE-2024-74785.8When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernam CVE-2024-74798.8Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer CVE-2024-74804.4An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with a CVE-2024-74818.8Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamVie CVE-2024-74847.2The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded CVE-2024-74857.2The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX fun CVE-2024-74868.8The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization o