SMTPTester

SMTPTester SMTPTesterは、SMTPサーバーを3つの一般的な脆弱性についてテストするPython3ツールです: スプーフィング - 内部ユーザーになりすましてメールを送信する能力 リレー - このSMTPサーバーを使用して組織外の他のアドレスにメールを送信すること ユーザー列挙 - SMTP VRFYコマンドを使用して、特定のユーザー名やメールアドレスが組織内に存在するかどうかを確認する 使い方 まず、必要な依存関係をインストールします: pip install -r requirements.txt 次に、必要なフラグを指定してツールを実行します: python...

CVE-2026-105322

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2026-105322 Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2026-105322

The Magee Shortcodes WordPress plugin (version 2.1.1 and below ) contains a vulnerability where it fails to restrict the recipient of certain unauthenticated contact-form actions. This flaw allows unauthenticated users to perform a mail relay attack, sending arbitrary emails to any destination th...

CVE-2026-105322 Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

EUVD-2026-94194

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

WordPress Magee Shortcodes plugin <= 2.1.1 - Unauthenticated Mail Relay vulnerability

Unauthenticated Mail Relay vulnerability discovered by Erwan LR WPScan in WordPress Plugin Magee Shortcodes versions = 2.1.1...

PT-2026-107416

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-78374

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374

T4 Page Builder (by joomlart.com) for Joomla, versions prior to 2.3.0 , is vulnerable to an open mail relay via its front-end JSON editor endpoint. The exposed contact action requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled), and has no rate limiting. An at...

EUVD-2026-75386

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

PT-2026-89353

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78374: Insertion of Sensitive Information Into Sent Data

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound...