gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 यह कमजोरी GitLab द्वारा पासवर्ड रीसेट के दौरान ईमेल सत्यापन को संभालने के तरीके में एक बग के कारण हुई थी। एक हमलावर पासवर्ड रीसेट अनुरोध के दौरान दो ईमेल पते प्रदान कर सकता था, और रीसेट कोड दोनों पतों पर भेजा जाता था। इससे हमलावर किसी भी...

CVE-2024-24139

CVE-2024-24139: ईमेल सत्यापन के साथ लॉगिन सिस्टम SQL Injection अवधारणा का प्रमाणPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md अवधारणा का प्रमाणPoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

CVE-2026-77508

Weblate , a web-based localization tool, is affected by an unverified email-change vulnerability prior to version 2026.8 . An authenticated user can modify their primary email via PUT or PATCH requests to /api/users/{username}/ without the new address being verified. This allows a subsequent team...

osint-tools-mcp-server

🔍 Servidor MCP de Ferramentas OSINT Um servidor MCP abrangente que expõe múltiplas ferramentas OSINT para assistentes de IA como Claude. Este servidor permite que a IA realize tarefas sofisticadas de reconhecimento e coleta de informações usando ferramentas OSINT padrão da indústria. 🛠️ Ferramenta...

poastal

Poastal - lo strumento OSINT per Email Poastal è uno strumento OSINT per email che fornisce informazioni preziose su qualsiasi indirizzo email. Con Poastal, puoi facilmente inserire un indirizzo email e risponderà rapidamente a diverse domande, fornendoti informazioni cruciali. ✨ Caratteristiche...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

anti-anti-automation

Anti-Anti-Automation Framework Ein Framework für Techniken zur Umgehung gängiger Sicherheitskontrollen gegen Automatisierung. Häufige Anti-Automatisierungs-Kontrollen E-Mail-Verifizierung CAPTCHA SMS/Telefon Kreditkarte WASC-21: Unzureichende Anti-Automatisierung...

EUVD-2026-36714

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak-Reset-Credentials-Bypass → Kontenübernahme Unauthentifizierte Kontenübernahme im Reset-Credentials-Ablauf von Keycloak. Ein Angreifer, der nur einen Benutzernamen/eine E-Mail-Adresse kennt, kann das Passwort eines beliebigen Benutzers zurücksetzen — einschließlich...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2021-34646

CVE-2021-34646 PoC Détail de la vulnérabilité par NVD Les versions jusqu'à et y compris la 5.4.3 du plugin Booster for WooCommerce pour WordPress sont vulnérables à un contournement d'authentification via la fonction processemailverification en raison d'une faiblesse dans la génération de jetons...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-64224

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

VulnCheck KEV: CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...