CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-64964

ATutor (open-source learning management system) is vulnerable to predictable email confirmation token generation in its account confirmation functionality. The root cause is the use of insufficiently random values tied to user registration, allowing an attacker who can predict these values to gue...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - toolchain de exploit XSS CSRF RCE PacketStorm WLB-2020080010 Aviso: este toolchain de exploit foi inspirado por EDB-ID 20009. Objetivo O objetivo deste toolchain de exploit é substituir o EDB-ID 20009. Vantagens deste toolchain sobre o exploit EDB-ID 20009:...

mime-is-broken

Kit de ferramentas para gerar e testar MIME quebrado Este é um kit de ferramentas para gerar e-mails com MIME quebrado, a fim de testar o comportamento de MUAs e produtos de segurança, ou seja, se eles estão em conformidade ou se MIME quebrado pode ser usado para contornar um produto de segurança...

GHSA-F965-GHFW-X6JX vulnerabilities

Vulnerabilities for packages: exim...

EUVD-2026-62915

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

PT-2026-79068

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2025-63419

CVE-2025-63419 CrushFTP antes da versão 11.3.760 é vulnerável a Injeção de HTML. O servidor baseado na web possui um recurso onde os usuários podem compartilhar arquivos; o recurso reflete o nome do arquivo em um campo de corpo de e‑mail sem sanitizações, levando à Injeção de HTML. CWE CWE-79 —...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Upload Arbitrário de Arquivos Autenticado Administrador+ via Parâmetro 'mdjmemailuploadfile' O plugin MDJM Event Management do WordPress versão 1.7.8.3 e anteriores contém uma vulnerabilidade de upload arbitrário de arquivos que permite a administradores...

CVE-2026-76350

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76350 Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

Bluto-Old

BLUTO O Bluto foi movido para um novo repositório; esta versão agora está obsoleta. A nova versão e o repositório podem ser encontrados em https://github.com/darryllane/Bluto Recursos da Versão Mais Recente: Reconhecimento de DNS Força bruta de subdomínios Transferências de Zona DNZ Verificações ...

CVE-2026-76574

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

CVE-2026-62317

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

CVE-2026-76574 code-projects Hospital Information System User Login UsersController.php login sql injection

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

EUVD-2026-62757

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

CVE-2026-62317 Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

CVE-2026-62317

CVE-2026-62317 is a ReDoS vulnerability in Logto (open-source auth infrastructure) prior to version 1.41.0. When the blockSubaddressing policy is enabled, the email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts constructs a regex (subaddressin...

CVE-2026-49976

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-19875

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...