Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

islechat

isle.chat A ssh powered chat server with public and private invite-only channels Each channel has an owner who can change its banner and invite users anyone can join if its public Demo it with ssh [email protected] This project is very new right now so don't rely on it for anything critical...

Tangled

Tangled Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail Google Workspace to deliver spoofed meeting invites that are...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2023-28810

CVE-2023-28810 CVE-2023-28810 的漏洞利用代码。 udp-config-changer.py 无需任何身份验证即可更改目标海康威视对讲机的运行配置。 udp-password-brute.py 尝试通过暴力猜解来恢复设备的管理员密码（未提供字典）。 SIP-ghost-caller.py 附赠代码：通过未经身份验证的 SIP INVITE 消息使目标对讲机振铃。...

CVE-2025-54320

CVE-2025-54320 邀请用户邮件轰炸 描述 邀请API未对目标电子邮件地址实施速率限制。这允许进行邮件轰炸攻击。 CVSS评分：7.1（高） 攻击类型 远程（已认证） 受影响版本 版本 8.6.8 发现者： Yazan Abu-Nadi...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

Bluewave Labs Checkmate versions up to and including 3.3.0 are affected by a privilege escalation vulnerability in the inviteController.js component. A remote authenticated administrator can exploit the role parameter at the /api/v1/invite endpoint to escalate their privileges to superadmin . The...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-44846

JumpServer (open-source bastion host) has a privilege escalation flaw in apps/users/api/user.py: a user with users.invite_user permission can POST to /api/v1/users/users/invite/ with an existing member, triggering user.org_roles.set(org_roles) which overwrites that member's org roles—escalating p...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

PT-2026-76813

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py t...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

EUVD-2026-54646

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717

CVE-2026-59717 affects the Android companion for Home Assistant prior to 2026.6.1. The issue is an open redirect in the homeassistant://invite flow where the URL fragment is passed into the onboarding WebView without displaying the destination hostname. As a result, a victim cannot distinguish a ...