CVE-2026-106647

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...

EUVD-2026-111705

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...

WordPress Booking Package plugin < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability

Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability discovered by Pedro Pinho in WordPress Plugin Booking Package versions 1.7.33...

CVE-2025-29471

Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ▶️ PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2026-109236 Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

EUVD-2026-111594

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

CVE-2026-109236 Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

CVE-2026-109236

The Customer Email Verification for WooCommerce plugin for WordPress (versions up to and including 2.8.2 ) is vulnerable to an Authentication Bypass via a predictable email-verification token. The root cause is the authenticate_user_by_email_link() function, which lacks capability checks and nonc...

CVE-2025-56132-Liquidfiles

CVE-2025-56132 - LiquidFiles User Enumeration POC Vulnerability Description This vulnerability was identified in LiquidFiles version 4.1 and below. When initiating a password reset via the “POST /passwordreset” endpoint, the application responds differently depending on whether the supplied email...

CVE-2012-2593

Atmail XSS-CSRF-RCE Exploit Chain PoC atmail-rce.py: Exploits CVE-2012-2593 in Atmail's webmail interface. atmail-csrf.js: Javascript file which leverages CVE 2012-2593 into a CSRF to install a malicious plugin which executes a reverse shell Plugin.php: Atmail plugin to be installed which calls a...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

cve-2023-22515-exp

cve-2023-22515-exp Python exploit script for cve-2023-22515 Arguments: -h, --help show this help message and exit -H HOST, --host HOST Specify the URL -U USERNAME, --username USERNAME Specify the username -PW PASSWORD, --password PASSWORD Specify the password -E EMAIL, --email EMAIL Specify the...

CVE-2023-5612

Disclosure of the public email in Tags RSS Feed https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the...

CVE-2024-42008-9-exploit

CVE-2024-42008-9-exploit The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7 Read more about these CVEs and how they can be exploited in the following link:...

CVE-2026-118175

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was...

XWiki < 4.10.15 - Email Disclosure

The Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email using XWiki's regular search interface. id: CVE-2023-50720 info: name: XWiki 4.10.15 - Email Disclosure author:...

Strapi Versions <=4.5.5 - SSTI to Remote Code Execution

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit in Roundcube Webmail Overview This repository contains a proof-of-concept PoC exploit for CVE-2024-42009 a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail version 1.6.7 and other several versions. The exploit demonstrates...

CVE-2018-15131

Zimbra Collaboration User Enumeration Script CVE-2018-15131 How to use The argument --host must be the hostname or IP address of Zimbra Collaboration Web Application root page, and --userlist an list of usernames to check against it. root@kali ./cve-2018-15131-user-enum.py --host...