551 matches found
MailRipV2
Mail.Rip V2.1337 Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support SOCKS4 / SOCKS5 with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working! Overview Legal...
EUVD-2026-116587
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke...
EUVD-2026-116588
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate othe...
CVE-2026-121729
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke...
CVE-2026-121730
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate othe...
CVE-2026-121730 emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate othe...
CVE-2026-121730 emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate othe...
CVE-2026-121729
The emailflare service (versions prior to commit cf31f33 ) is vulnerable to a missing authorization flaw in the inbox service /api/keys routes. This vulnerability allows any authenticated member to list, create, and revoke API keys. An attacker can exploit this to mint a global live API key—which...
CVE-2026-121729 emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke...
CVE-2026-121730
The emailflare application (versions prior to commit cf31f33 ) contains a missing authorization vulnerability in the POST /api/inbox/compose endpoint. This flaw allows authenticated members to send emails by supplying an arbitrary from field, which is passed unchecked to the Cloudflare send call....
CVE-2026-121729 emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke...
CVE-2024-42008-9-exploit
CVE-2024-42008-9-exploit The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7 Read more about these CVEs and how they can be exploited in the following link:...
CVE-2018-8581
CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level. It can be used to delegate and take over the inbox of other users including domain administrators after obtaining the credentials of a regular mailbox account. This EXP script is an enhanced...
CVE-2021-33766
POC Exploit CVE-2021-33766 ProxyToken POC Exploit for CVE-2021-33766 ProxyToken is a handy shell script which provides pentesters and security researchers a quick and effective way to test Microsoft Exchange ProxyToken vulnerability. Disclaimer This program is for Educational purpose ONLY. Do not...
CVE-2018-8581
CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level Once you have the credentials of an ordinary mailbox account, it allows you to delegate and take over the inboxes of other users including domain administrators This EXP script is an enhanced...
CVE-2026-118543
Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...
DRUPAL-CONTRIB-2026-258
This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token...
PT-2026-130573
This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token...
Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token...
EUVD-2026-110532
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...