SMTPTester

SMTPTester SMTPTester is a python3 tool to test SMTP server for 3 common vulnerabilities: Spoofing - The ability to send a mail on behalf of an internal user Relay - Using this SMTP server to send email to other address outside of the organization user enumeration - using the SMTP VRFY command to...

CVE-2026-114473

Incorrect authorization in the Sender Rewriting Scheme SRS of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at...

CVE-2026-114473 Incorrect Authorization in hMailServer

Incorrect authorization in the Sender Rewriting Scheme SRS of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at...

CVE-2026-114473

Progressive Robot hMailServer versions 6.2.1 through 6.3.6 are vulnerable to an incorrect authorization flaw within the Sender Rewriting Scheme (SRS) . When SRS is enabled, the server fails to apply relay rules and SMTP authentication because it incorrectly treats messages sent to a valid SRS add...

EUVD-2026-107316

Incorrect authorization in the Sender Rewriting Scheme SRS of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at...

CVE-2026-114473 Incorrect Authorization in hMailServer

Incorrect authorization in the Sender Rewriting Scheme SRS of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at...

PT-2026-120651

Incorrect authorization in the Sender Rewriting Scheme SRS of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at...

CVE-2026-94235: Missing Authorization

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

CVE-2026-105322

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

WordPress Magee Shortcodes plugin <= 2.1.1 - Unauthenticated Mail Relay vulnerability

Unauthenticated Mail Relay vulnerability discovered by Erwan LR WPScan in WordPress Plugin Magee Shortcodes versions = 2.1.1...

CVE-2026-105322 Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2026-105322 Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

EUVD-2026-94194

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2026-105322

The Magee Shortcodes WordPress plugin (version 2.1.1 and below ) contains a vulnerability where it fails to restrict the recipient of certain unauthenticated contact-form actions. This flaw allows unauthenticated users to perform a mail relay attack, sending arbitrary emails to any destination th...

CVE-2026-105322: External Control of Assumed-Immutable Web Parameter

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

PT-2026-107416

Name of the Vulnerable Software and Affected Versions Magee Shortcodes WordPress plugin versions prior to 2.1.2 Description The plugin fails to restrict the recipient of certain unauthenticated contact-form actions. This allows unauthenticated users to perform a mail relay, sending arbitrary emai...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...