580 matches found
OpenRelayMagic
OpenRelayMagic root@kitploit: ╔═╗┌─┐┌─┐┌┐┌╦═╗┌─┐┬ ┌─┐┬ ┬╔╦╗┌─┐┌─┐┬┌─┐ ║ ║├─┘├┤ │││╠╦╝├┤ │ ├─┤└┬┘║║║├─┤│ ┬││ ╚═╝┴ └─┘┘└┘╩╚═└─┘┴─┘┴ ┴ ┴ ╩ ╩┴ ┴└─┘┴└─┘ 用于测试SMTP服务器上易受攻击的开放中继的工具 功能 检查单个目标/域名列表 支持587和465端口 多线程...
CVE-2024-45519
CVE-2024-45519 SMTP Vulnerability Exploit Script Overview This script checks for vulnerabilities in an SMTP server and, if found, exploits the vulnerability by establishing a reverse shell connection to your machine. Features root@kitploit: Port Checking: Verifies if the target SMTP port is open...
OpenSMTPD-CVE-2020-7247-
Vulnerabilidad de ejecución remota de comandos en OpenSMTPD CVE-2020-7247 WHS 4기 박솔민 Enlace original: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md Resumen OpenSMTPD es un programa servidor SMTP utilizado en sistemas operativos ti...
-CVE-2026-23829-CTT-Mailpit-phase-reconstruction-
SimoesCTT-mailpit-phase-reconstructor Es una inyección CRLF en el servidor SMTP de Mailpit: una vulnerabilidad clásica de corrupción de datos. Pero bajo CTT, no es solo un bug. Es una oportunidad de reconstrucción de fase. CVE-2026-23829 root@kitploit: CTT-Mailpit-Phase-Reconstructor CVE-2026-238...
CVE-2026-75123
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
EUVD-2026-67783
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75123
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization, allowing a remote attacker...
CVE-2026-66141 vulnerabilities
Vulnerabilities for packages: exim...
GHSA-F965-GHFW-X6JX vulnerabilities
Vulnerabilities for packages: exim...
GHSA-Q496-Q274-JGH9 vulnerabilities
Vulnerabilities for packages: exim...
Vantage6: No limit on emails sent for password/MFA reset
ImpactUsers can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam...
PYSEC-2026-3399 Vantage6: No limit on emails sent for password/MFA reset
Impact Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam...
PYSEC-2026-1111 aiosmtpd STARTTLS unencrypted commands injection
Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack. References NO STARTTLS: Similar vulnerabilities discovered by previous researchers...
@3ngram/server (0.7.0), @compeso/node-red-contrib-imap-email (1.0.0) +8 more potentially affected by unknown CVE via nodemailer (9.0.0)
nodemailer NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nodemailer and may be impacted: - @3ngram/server 0.7.0 - @compeso/node-red-contrib-imap-email 1.0.0 - @hybridaione/hybridclaw =0.25.3, =2.71.0, =2.72.0 - imapflow 1.4.1 -...
BIT-DISCOURSE-2026-44784 Discourse: Non-staff group owners can see email password in plaintext through group history
Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via the group history...
CVE-2026-44784 Discourse: Non-staff group owners can see email password in plaintext through group history
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext...
