EUVD-2026-110493

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirec...

buster

Description Buster is an advanced OSINT tool used to: Get social accounts of an email using multiple sourcesgravatar,about.me,myspace,skype,github,linkedin,previous breaches Get links to where the email was found using google,twitter,darksearch and paste sites Get breaches of an email Get domains...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

CVE-2026-116745

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirec...

Consensus-OSINT

Usernames. Emails. Phone Numbers. 19 Projects. One Tool. By the OSINT Experts Society A unified lookup tool combining 9,700+ modules and site rules from 19 open-source projects, maintained by our experts, with a weekly review target. Install · See it in action · Features · Compare · Updates !Join...

CVE-2026-116745 QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirec...

CVE-2026-116745

QloApps versions up to and including 1.7.0 are vulnerable to an information disclosure vulnerability within the OrderConfirmationController::init() function. Unauthenticated attackers can exploit this by providing guest id_cart values to obtain guest order references and emails. By iterating thro...

mapsdumper

▒█▀▄▀█ ░█▀▀█ ▒█▀▀█ ▒█▀▀▀█ ▒█▀▀▄ ▒█░▒█ ▒█▀▄▀█ ▒█▀▀█ ▒█▀▀▀ ▒█▀▀█ ▒█▒█▒█ ▒█▄▄█ ▒█▄▄█ ░▀▀▀▄▄ ▒█░▒█ ▒█░▒█ ▒█▒█▒█ ▒█▄▄█ ▒█▀▀▀ ▒█▄▄▀ ▒█░░▒█ ▒█░▒█ ▒█░░░ ▒█▄▄▄█ ▒█▄▄▀ ░▀▄▄▀ ▒█░░▒█ ▒█░░░ ▒█▄▄▄ ▒█░▒█ by: @Tegal1337 MAPSDUMPER Demo • Installation • Feature • Credits A tool for dumping place details from Goog...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

reconspider

Most Advanced Open Source Intelligence OSINT Framework ReconSpider ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers,...

ai-email-threat-research

Threat Terminal A cybersecurity research game measuring how humans detect AI-generated phishing emails. Built as a retro terminal experience. Live: research.scottaltiparmak.com The Problem AI can now generate phishing emails with perfect grammar, flawless spelling, and convincing context. The old...

CVE-2025-55903

CVE-2025-55903: Stored HTML Injection in PerfexCRM ⚠️ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, billing, and automated communications -ff6600 📋 Overview A Stored HTML Injection vulnerability has been discovered in PerfexCRM that allows authenticated users...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

toutatis

Toutatis 👋 Hi there! For any professional inquiries or collaborations, please reach out to me at: [email protected] 📧 Preferably, use your professional email for correspondence. Let's keep it short and sweet, and all in English! Toutatis is a tool that allows you to extract information from...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

Qubely WordPress plugin 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubelysendformdata AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication. id: CVE-2021-24916 info: name:...

Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery

Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints including /webhooks/mailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost without validating a token when none is configured, which is the default state, letti...

Post SMTP <= 3.6.0 - Email Log Disclosure

Post SMTP WordPress plugin = 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication. id: CVE-2025-11833 info: name: Post SMTP = 3.6.0 -...

responsible-disclosure-email-gathering

Responsible Disclosure Email Gathering Purpose You may have found a vulnerability on a host but the said host/org does not have an active program on HackerOne or BugCrowd. If this is the case this workflow is for you! Broadly it will crawl the website and look for any security related emails from...