EUVD-2026-86335

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2023-48104

CVE-2023-48104 HTML Injection in Alinto/SOGo Web Client Vendor of Product Alinto Vulnerability Type HTML Injection Affected Versions SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Discoverer Spiridonov Ivan/E1tex PoC For demonstration purposes only. P...

Silent_CVE_2019_16394

CVE-2019-16394 A simple POC python script of CVE-2019-16394 Script is adjusted for a french website, you may need to modify it if the website language is different. Install root@kitploit: pip install -r requirements.txt Usage root@kitploit: usage: cve201916394.py -h -u URL -f FILE -v optional...

exploit-CVE-2016-9920

Roundcube 1.0.0 = 1.2.2 Remote Code Execution Roundcube is a widely distributed open-source webmail software used by many organizations and companies around the globe. The mirror on SourceForge, for example, counts more than 260,000 downloads in the last 12 months which is only a small fraction o...

thunderbird: One byte overflow read in mail parser

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior...

thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers

A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to...

CVE-2022-27925

Zimbra Unauthenticated Remote Code Execution Exploit CVE-2022-27925...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2024-37383-exploit

Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...

opsxcq-cve-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2025-47176

CVE-2025-47176 PoC Browser Bridge Description This proof-of-concept PoC demonstrates the CVE-2025-47176 vulnerability simulation. It injects a crafted mail item into Outlook containing a malicious sync path that triggers an action during scanning. IMPORTANT: This PoC simulates the vulnerable...

CVE-2026-77637

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET"wopi" and tool.POST"mail" in routers/router.go inherit ScopeAdminRead but omit the RequiredScopestypes.ScopeAdminWrite middleware applied to neighboring state-changing admin tool routes. An OAuth application ...

CVE-2026-77637 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET"wopi" and tool.POST"mail" in routers/router.go inherit ScopeAdminRead but omit the RequiredScopestypes.ScopeAdminWrite middleware applied to neighboring state-changing admin tool routes. An OAuth application ...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2024-39929

Exim CVE-2024-39929 Exploit PoC This repository contains a Proof-of-Concept PoC script to exploit the Exim vulnerability CVE-2024-39929. The vulnerability affects Exim versions prior to 4.98, allowing attackers to bypass file extension blocking mechanisms and potentially deliver executable...