463 matches found
mailMeta
A forensic tool to make analysis of email headers easy to aid in the quick discovery of the attacker. Table of Contents About mailMeta Installation Usage Linux Windows Demo Contributions Inspiration FAQ License About mailMeta What is mailMeta? mailMeta is a python based forensic tool which reads...
email-header-analyzer
E-Mail Header Analyzer MHA What is E-Mail header analyzer MHA: E-Mail header analyzer is a tool written in flask for parsing email headers and converting them to a human readable format and it also can: Identify hop delays. Identify the source of the email. Identify hop country. MHA is an...
CVE-2026-33454
camel-mail Header Injection → RCE Vulnerability Reproducer CVE-2026-33454 This project demonstrates a Camel message header injection vulnerability in Apache Camel's camel-mail component, tracked as CVE-2026-33454. An attacker who can deliver an email to a mailbox monitored by a Camel mail consume...
CVE-2026-34975
CVE-2026-34975 — CRLF Email Header Injection in Plunk via raw MIME construction Severity : High CVSS 8.5 CWE : CWE-93 — Improper Neutralization of CRLF Sequences 'CRLF Injection' Affected : useplunk/plunk = 0.7.1 Fixed in : 0.8.0 Advisory : GHSA-2mvm-rg5v-7hfq NVD :...
Astra Linux – Vulnerability in Python 3.11, Python 3.7
When folding a long comment within an email header that contains only printable characters, the parentheses will not be preserved. This can be exploited to inject headers into email messages where the addresses are controlled by users and not sanitized...
CVE-2026-86813
CVE-2026-86813 affects the MetForm WordPress plugin prior to version 4.1.9 . The vulnerability resides in how the plugin handles newline characters in user-submitted values that are placed into notification email headers, specifically the Reply-To field. An unauthenticated attacker can inject add...
CVE-2026-86813 MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...
EUVD-2026-76041
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...
UBUNTU-CVE-2026-61908
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...
CVE-2026-61908
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...
CVE-2026-19862
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
EUVD-2026-72090
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
CVE-2026-19862
JetFormBuilder WordPress plugin versions before 3.6.5.2 are vulnerable to unauthenticated email header injection via the Send Email action. The root cause is that the plugin does not validate or strip line breaks from address values sourced from submitted form fields before including them in outg...
CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
EUVD-2026-69652
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-40014
A flaw was found in Dovecot. A remote attacker, by sending a specially crafted email message header to a user, can cause the Internet Message Access Protocol IMAP THREAD command to consume excessive CPU resources. When a mail client processes this message, it can lead to degradation or a denial o...
CVE-2026-55619
eml_parser , a Python module for parsing EML files, is vulnerable to a denial of service prior to version 3.0.2 . The flaw resides in eml_parser.parser.HeaderParser.header_fetch_parse, which delegates address parsing to email.utils.getaddresses(). A deeply nested CFWS comment construct in an e-ma...
