Tangled

Tangled Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail Google Workspace to deliver spoofed meeting invites that are...

islechat

isle.chat A ssh powered chat server with public and private invite-only channels Each channel has an owner who can change its banner and invite users anyone can join if its public Demo it with ssh [email protected] This project is very new right now so don't rely on it for anything critical...

CVE-2023-28810

CVE-2023-28810 Exploit code for CVE-2023-28810. udp-config-changer.py Change the running configuration of a target hikvision intercom without needing any authentication. udp-password-brute.py Attempt to recover the admin password for the device via brute force guessing wordlist not supplied...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

CVE-2025-54320

CVE-2025-54320 Invite User Email Bombing Description The invitation API does not implement rate limiting for the target email address. This allows for an Email Bombing attack. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Na...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

UBUNTU-CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

DEBIAN-CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

CVE-2026-57187 Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

CVE-2026-57187 Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

CVE-2026-57187

The Asterisk telephony toolkit is vulnerable to a heap-use-after-free in PJSIP TCP/SDP handling. An authenticated attacker can trigger this by sending a SIP INVITE over a connection-oriented transport and disconnecting before the server responds with a 200 OK. While the crash has only been reprod...

EUVD-2026-110076

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

PT-2026-125108

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...

bomiot (>=0.2.86, <=0.8.5), cashd (>=0.2.0, <=0.3.4.post1) +9 more potentially affected by CVE-2026-115776 via twisted (24.7.0)

twisted PYPI version 24.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - bomiot =0.2.86, =0.2.0, =0.7.1, =0.3.1, =0.8.1, =4.0.0, =4.0.0, =0.1.0, =0.6.2, =0.1.0, =0.0.1, =0.1.5 Source cves: CVE-2026-115776 Source...

bomiot (>=0.2.86, <=0.8.5), cashd (>=0.2.0, <=0.3.4.post1) +9 more potentially affected by CVE-2026-115778 via twisted (24.7.0)

twisted PYPI version 24.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - bomiot =0.2.86, =0.2.0, =0.7.1, =0.3.1, =0.8.1, =4.0.0, =4.0.0, =0.1.0, =0.6.2, =0.1.0, =0.0.1, =0.1.5 Source cves: CVE-2026-115778 Source...

CVE-2026-65824

OpenReception's appointment booking software (prior to version 2.2.1 ) is vulnerable to a replay attack involving invite confirmation tokens. An attacker capturing a pending token can replay it to obtain a passkey-registration credential, allowing them to register their own passkey and take contr...

CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...