CVE-2020-7247-POC

Prefacio Datos clave sobre el exploit Instalación del servidor vulnerable Configuración Avisos sobre el entorno Exploit Explotación manual Explotación mediante script Prefacio Este repositorio debe servir como base para configurar y explotar CVE-2020-7247 en un entorno controlado y privado. Todo ...

AlmaLinux 9.2 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (ALMALINUX9.2:CLSA-2025:1738267482)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1738267482 advisory. - Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

CVE-2020-7247-reproducer

CVE-2020-7247 OpenSMTPD Información Este repositorio contiene los archivos necesarios para construir una imagen de Docker que contiene un entorno vulnerable de OpenSMTPD 6.6.1p1. La vulnerabilidad permite a un atacante ejecutar comandos arbitrarios a través de una sesión SMTP especialmente...

Astra Linux – Vulnerability in exim4

Before version 4.97.1, Exim allowed SMTP smuggling in certain pipeline/chunking configurations. Remote attackers could use a known exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, thereby bypassing an SPF protection mechanism. This issue arises because Exim...

Astra Linux – Vulnerability in sendmail

Sendmail in version 8.17.2 allows for SMTP smuggling in certain configurations. Remote attackers can utilize a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, thereby bypassing an SPF protection mechanism. This issue arises because Sendmail supports...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 has an improper neutralization of line delimiters. An authenticated remote SMTP client can insert newline characters into a spool file which indirectly leads to remote code execution as root via the AUTH= parameter in the MAIL FROM command...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 has an improper restriction on write operations within the bounds of a memory buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands...

CVE-2025-68624

N-able Mail Assure (formerly SolarWinds MSP Mail Assure), a cloud-based multi-tenant SMTP relay, contains a design-level authorization flaw (CWE-290) where an authenticated SMTP user can send outbound mail using MAIL FROM addresses of other tenants . After valid SMTP AUTH, the server accepts arbi...

DEBIAN-CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

UBUNTU-CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

EUVD-2026-76774

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, enabling ESMTP parameter injection into MAIL FROM and RCPT TO envelope commands. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters such as AUTH , NOTIFY , or ORC...

CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

PT-2026-90555

Name of the Vulnerable Software and Affected Versions aiosmtplib versions prior to 5.1.3 Description The software fails to properly validate email addresses provided by callers, which enables ESMTP parameter injection into the MAIL FROM and RCPT TO command lines. By crafting malicious addresses...

CVE-2026-90467: Improper Neutralization of Argument Delimiters in a Command

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

UBUNTU-CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...