CVE-2023-5561-PoC

CVE-2023-5561-PoC WordPress는 REST API를 통해 검색 가능한 사용자 필드를 적절히 제한하지 않아, 인증되지 않은 공격자가 Oracle 스타일 공격을 통해 영향받은 웹사이트에 공개 게시물을 작성한 사용자의 이메일 주소를 알아낼 수 있습니다. 출처: https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441/...

CVE-2023-23397

CVE-2023-23397 보안 테스트를 위한 CVE-2023-23397 개념 증명. 11행과 12행을 공격자 UNC 경로와 대상 이메일 주소로 수정하십시오...

socialscan

socialscan socialscan offers accurate and fast checks for email address and username usage on online platforms. Given an email address or username, socialscan returns whether it is available, taken or invalid on online platforms. Features that differentiate socialscan from similar tools e.g...

poastal

Poastal - the Email OSINT tool Poastal is an email OSINT tool that provides valuable information on any email address. With Poastal, you can easily input an email address and it will quickly answer several questions, providing you with crucial information. ✨ Features Determine the name of the...

WP-CVE-2016-10033

WordPress -p 8000:80 앞의 8000은 호스트 머신의 포트를 나타내며 임의로 지정할 수 있습니다. http://127.0.0.1:8000에 접속하여 WordPress 메인 화면이 보이면 시작 성공입니다. POC 대상 주소가 http://127.0.0.1:8000/ 인 경우: 1. 아래 HTTP 요청을 BurpSuite Repeater에 복사하고 Go 버튼을 클릭한 후 대상 IP와 포트를 입력합니다 예: IP: 127.0.0.1, 포트: 80 POST /wp-login.php?action=lostpassword...

CVE-2018-10949

Zimbra Collaboration 사용자 열거 스크립트 CVE-2018-10949 사용 방법 --host 인자는 Zimbra Collaboration 웹 애플리케이션 루트 페이지의 호스트명 또는 IP 주소여야 하며, --userlist는 확인할 사용자 이름 목록입니다. root@kali ./cve-2018-10949-user-enum.py --host http://mail.target.com --userlist /tmp/emails.txt 그러면 유효한 이메일이 출력됩니다! 참고 자료:...

CVE-2026-96962

The Pie Register WordPress plugin (versions prior to 3.8.4.14 ) contains a vulnerability where it fails to restrict access to an invitation-code report . This flaw allows unauthenticated visitors to obtain the usernames and email addresses of all users who registered using a specific, known invit...

EUVD-2026-91949

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

EUVD-2026-91890

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

PT-2026-104535

Name of the Vulnerable Software and Affected Versions The Pie Register WordPress plugin versions prior to 3.8.4.14 Description The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and...

CVE-2026-104439

YesWiki versions prior to 4.6.7 are vulnerable to a user enumeration vulnerability within the LostPasswordAction.php component. Unauthenticated attackers can confirm registered email addresses by submitting emails to the MotDePassePerdu recovery page and analyzing the differing responses. The lac...

Proxylogon-exploit

Proxylogon-exploit proxylogon 익스플로잇 - CVE-2021-26857 사용법: python exploit.py...

CVE-2026-103280

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-103280

The Ghost content management system, versions 0.8.0 before 6.23.0 , is susceptible to an information disclosure vulnerability. The setup endpoint fails to perform proper authentication and responds to unauthenticated requests by revealing the site owner's email address . This allows any remote vi...

CVE-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-100143 FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

EUVD-2026-87896

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CLEANSTART-2026-GQ93723 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the loki package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...