CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

CVE-2026-54390

CVE-2026-54390 — JTL Shop Smarty SSTI 一括エクスプロイト 認証前のお問い合わせフォーム → メール件名 → fetch'string:' → RCE 概要 CVE-2026-54390 は、JTL Shop 5.2.0–5.7.1 における緊急 CVSS 9.8 レベルの認証不要のサーバーサイドテンプレートインジェクション SSTI です。 SmartyRenderer::renderTemplate メソッドは、メールの件名行を $smarty-fetch'string:' . $subject に渡し、Smarty...

CVE-2026-95682: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = " ";. Because the value was placed inside a double-quoted...

CVE-2025-25965

CVE-2025-25965: Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.2 Introduction Cross-Site Request Forgery CSRF remains one of the most overlooked yet dangerous vulnerabilities affecting web applications today. CVE-2025-25965 is a newly discovered CSRF vulnerability in the...

CVE-2026-55210

Joplin Server prior to 3.7.2 contains a vulnerability in UserModel.ssoLogin() where the method returns an existing account matched by an IdP-asserted email without checking the is_external flag . In deployments using mixed local and SAML authentication , an attacker whose IdP session can assert a...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit in Roundcube Webmail Overview This repository contains a proof-of-concept PoC exploit for CVE-2024-42009 a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail version 1.6.7 and other several versions. The exploit demonstrates...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "email" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor ca...

CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

UBUNTU-CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-48974 HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any...

CVE-2026-93012

The Email::Sender::Transport::Sendmail Perl module (versions before 2.602 ) is vulnerable to arbitrary command execution on Windows systems. The issue resides in the _sendmail_pipe function, where the module concatenates the envelope sender and every recipient into a single command string that is...

CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2024-21413-Vulnerabilidad-Outlook-LAB

CVE-2024-21413 – Outlook LAB Vulnerability Vulnerability Description CVE-2024-21413 is a critical vulnerability discovered in Microsoft Outlook that allows a remote attacker to execute malicious links via a carefully crafted email. This exploit uses the file:// protocol to redirect victims to...

CVE-2019-16759

vBulletin RCE 5.x Obtener Email + SMTP CVE-2019-16759 Esta herramienta extrae y vuelca Email + SMTP del servidor de base de datos USO root@kitploit: $ git clone https://github.com/mas1337/CVE-2019-16759.git && cd CVE-2019-16759 $ ./vb-email-smtp.sh list.txt Aviso legal Todo el código en este...

Mailphish

Mailphish Codificado por Pro MCracker Mailphish te ayudará a crear correos electrónicos de phishing profesionales de forma rápida y fácil Visita nuestros sitios web para aprender métodos de hacking https://crackcodes.xyz y https://crackcodes.in Si copias el código y haces el tuyo propio, ¡no...

CVE-2024-42009

Exploit XSS para Roundcube Webmail 1.6.7 CVE-2024-42009 Descripción Este script explota una vulnerabilidad XSS almacenada CVE-2024-42009 en Roundcube Webmail versión 1.6.7. Inyecta una carga útil maliciosa en el sistema de webmail que, al activarse, extrae el contenido del correo electrónico de l...

CVE-2026-42758

CVE-2026-42758 CVE-2026-42758 WebinarIgnition Exploit Usage Examples Basic Usage python3 exploit.py https://target.example.com -e [email protected] Specify Webinar Page python3 exploit.py https://target.example.com -e [email protected] -w https://target.example.com/webinar/my-webinar/...

CVE-2021-41349

¡Exploit CVE-2021-41349! ¡Exploit de la Vulnerabilidad de Suplantación en Microsoft Exchange Server! ¡Pasos para Reproducir! 1. Realiza una solicitud HTTP como esta y captúrala con Burp 2. Crea un PoC CSRF de esa solicitud y guarda la salida HTML en un archivo 3. Abre la salida guardada en un...