CVE-2026-61816 zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerabili...

CVE-2026-61815

The zbateson/mail-mime-parser library is vulnerable to CRLF header injection (CWE-93) in versions prior to 3.0.6 and 4.0.2 . The root cause is the interpolation of attacker-influenced attachment filenames into Content-Type and Content-Disposition headers without stripping CR/LF characters. This a...

EUVD-2026-86335

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2023-48104

CVE-2023-48104 Alinto/SOGo Web Client における HTML インジェクション 製品ベンダー Alinto 脆弱性の種類 HTML インジェクション 影響を受けるバージョン SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 発見者 Spiridonov Ivan/E1tex PoC デモンストレーション目的のみ。PoC エクスプロイトは脆弱な SOGo クライアントで動作します。...

Silent_CVE_2019_16394

CVE-2019-16394 CVE-2019-16394 のシンプルな POC Python スクリプト スクリプトはフランス語のウェブサイト向けに調整されています。ウェブサイトの言語が異なる場合は修正が必要かもしれません。 インストール root@kitploit: pip install -r requirements.txt 使い方 root@kitploit: usage: cve201916394.py -h -u URL -f FILE -v optional arguments: -h, --help show this help message and exit -u...

exploit-CVE-2016-9920

Roundcube 1.0.0 在 Roundcube 1.2.2 及更早版本中，用户控制的输入未经处理地流入 PHP 内置函数 mail 的第五个参数，该参数在安全方面被标记为关键。问题在于，调用 mail 函数将导致 PHP 执行 sendmail 程序。第五个参数允许向该执行传递额外参数，从而可以配置 sendmail。由于 sendmail 提供了 -X 选项，可以将所有邮件流量记录到文件中，攻击者可以利用此选项在受攻击服务器的 webroot 目录中生成一个恶意 PHP 文件。尽管此漏洞较为罕见且未广泛知晓，但 RIPS 在几秒钟内就检测到了它。 4 利用...

thunderbird: One byte overflow read in mail parser

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior...

thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers

A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

Security Bulletin: Multiple Vulnerabilities were found in IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import...

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2024-37383-exploit

エクスプロイトタイトル: CVE-2024-37383 保存型XSS に対するRoundcubeメールサーバーエクスプロイト Google Dork: エクスプロイト作成者: AmirZargham ベンダーホームページ: Roundcube - フリーでオープンソースのWebメールソフトウェア ソフトウェアリンク: リリース · roundcube/roundcubemail バージョン: 1.5.6より前、または1.6から1.6.6のRoundcubeクライアントバージョン テスト環境: Firefox, Chrome CVE: CVE-2024-37383 CWE: CWE-79...

opsxcq-cve-2016-10033

PHPMailer 5.2.18 リモートコード実行 PHPMailerは世界で最も人気のあるトランスポートクラスであり、推定900万人のユーザーが世界中にいます。ダウンロードは毎日かなりのペースで続いています。多くのオープンソースプロジェクト（WordPress、Drupal、1CRM、SugarCRM、Yii、Joomla!など）で使用されています。...

CVE-2025-47176

CVE-2025-47176 PoC ブラウザブリッジ 説明 この概念実証（PoC）は、CVE-2025-47176 の脆弱性シミュレーションを示しています。悪意のある同期パスを含む巧妙に細工されたメールアイテムを Outlook に注入し、スキャン中にアクションをトリガーします。 重要: この PoC は、脆弱な Outlook のパス解析をシミュレートし、悪意のあるパスが検出されるとシステムの再起動 をトリガーします。 malicious.prf を使用した追加テスト この PoC は、巧妙に細工された Outlook プロファイル...

CVE-2026-77637

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET"wopi" and tool.POST"mail" in routers/router.go inherit ScopeAdminRead but omit the RequiredScopestypes.ScopeAdminWrite middleware applied to neighboring state-changing admin tool routes. An OAuth application ...

CVE-2026-77637 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET"wopi" and tool.POST"mail" in routers/router.go inherit ScopeAdminRead but omit the RequiredScopestypes.ScopeAdminWrite middleware applied to neighboring state-changing admin tool routes. An OAuth application ...