CVE-2024-30270-PoC

此脚本旨在利用跨站脚本（XSS）和远程代码执行（RCE）漏洞攻击 Mailcow 实例。该脚本的目标为： 向 Mailcow Web 界面注入 XSS 载荷。 利用 XSS 载荷执行未经授权的操作。 通过覆盖服务器模板并执行命令实现 RCE。 要求 1. Python 3：确保你的机器上已安装 Python 3。你可以从官方网站下载（https://www.python.org/downloads/）。 2. Requests 库：如果尚未安装 requests 库，请先安装。可通过运行以下命令安装： pip install requests 3. 目标 Mailcow...

CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

CVE-2026-90944

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

EUVD-2026-77711

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944

Krayin CRM through version 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without requiring authentication. An unauthenticated attacker can supply crafted RFC 2822 messages with forged sender information and headers to inject arbitrary emails into the CRM inbox, including replies to ex...

CVE-2026-90944: Missing Authentication for Critical Function

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-79621

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

EUVD-2026-69845

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621

The CatalogX WordPress plugin (versions before 6.1.3 ) is vulnerable to an Unauthenticated Email Content Injection due to a lack of proper sanitization and escaping of user-supplied content. An unauthenticated attacker can store malicious content that is later included in product enquiry notifica...

WordPress CatalogX plugin < 6.1.3 - Unauthenticated Email Content Injection vulnerability

Unauthenticated Email Content Injection vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Product Catalog Enquiry for WooCommerce by MultiVendorX versions 6.1.3...

CVE-2026-79621: Insufficient Verification of Data Authenticity

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

PT-2026-78452

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contact id offer / contact id event instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

EUVD-2026-57177

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...