SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: مرجع كائن مباشر غير آمن ثغرة IDOR في SOGo Webmail المُبلّغ: ميلاد صديق المنتج: SOGo الإصدارات المتأثرة: v5.6.0 التأثير: مرجع كائن مباشر غير آمن ثغرة IDOR → يسمح للمستخدم بإرسال رسائل بريد إلكتروني نيابة عن مستخدم آخر. ملخص تم اكتشاف ثغرة مرجع كائن مباشر غير آمن IDOR في SOGo Webmai...

CVE-2018-8718

Exploit Title : Jenkins ثغرة CSRF في مكوّن mailer - إرسال بريد CSRF Date : 2018/06/05 Exploit Author : Yeom Geun Cheol Vendor Homepage : https://jenkins.io/ Software Link : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi Version: أقل من الإصدار 1.20 1.1 1.20 Tested on : Linux ,...

CVE-2023-23397-PoC

CVE-2023-23397-PoC نسخة C للإرسال فقط من CVE-2023-23397-POC-Powershell بواسطة Oddvar Moe @oddvarmoe يرسل بريدًا إلكترونيًا من العنوان المرتبط بحساب Outlook. root@kitploit: .\CVE202323397.exe --help CVE202323397 1.0.0.0 Copyright c 2023 -t, --to Required. Recipient email address -p, --path Require...

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

Qubely WordPress plugin 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubelysendformdata AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication. id: CVE-2021-24916 info: name:...

Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending

Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication. id: CVE-2026-0829...

CVE-2026-37073

CVE-2026-37073 التحكم غير الصحيح في الوصول في /vfm-admin/ajax/sendfiles.php في مشروع Veno File Manager 4.4.9 يسمح لمهاجم غير مصادق بإرسال رسائل بريد إلكتروني من خادم SMPT المكوّن في التطبيق عبر إجراء طلب POST إلى النقطة النهائية مع المعلمات والرأس المطلوبين...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending vulnerability

Unauthenticated Arbitrary Recipient Email Sending vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WPFunnels versions 3.13.0...

CVE-2026-79632

The WPFunnels WordPress plugin before 3.13.0 lacks an authorisation or nonce check in its wpfnl_shortcode_optin_submission handler. Because the notification recipients and subject are taken directly from the request, unauthenticated users can cause the site to send emails to arbitrary recipients ...

CVE-2026-17520

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...

CVE-2026-17520

The Newsletters WordPress plugin before 4.17 fails to generate its API key from a sufficiently random source, instead deriving it from a publicly known value . When the plugin's optional API is enabled, this allows unauthenticated attackers to compute the key and perform privileged actions such a...

CVE-2026-16269

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

CVE-2026-16269

The Newsletters WordPress plugin (before 4.16) fails to strictly compare its API authentication key, enabling an unauthenticated bypass of API authentication through type juggling. This allows attackers to perform privileged actions when the optional API is enabled, such as modifying subscriber r...

CVE-2026-16774

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

PYSEC-2026-1297 Django allows enumeration of user e-mail addresses

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome only...

CVE-2026-43880

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated...

CVE-2026-4888 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...

CVE-2026-4888 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...

WordPress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending vulnerability

Missing Authorization to Authenticated Subscriber+ Email Sending vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Plugin Everest Forms versions = 3.4.7...

MAL-2026-4772 Malicious code in txdpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 767f0e720df9d2dd670fc9c607db01794649653be89daa42f01dfe34a69a8ecd The package exports a 发送邮件 sendemail function whose default sender, recipient, and SMTP auth code are hardcoded to the author's QQ account. In...

CVE-2026-43880

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated...