SocialEngineering

SOCIAL ENGINEER 🎯🕵️‍♂️ 一个功能强大的社会工程学工具包，可自动化网络钓鱼、OTP/邮箱轰炸、伪造邮件等攻击 — 由 @karthithehacker 用 ❤️ 打造 ⚠️ 仅供教育用途。未经明确许可，请不要 使用此工具针对任何人。 📌 功能特性 🎯 网络钓鱼攻击 – 模拟虚假登录页面以窃取凭据 🔢 OTP 轰炸 – 向目标号码发送大量 OTP 请求 📩 邮箱轰炸 – 群发邮件以扰乱收件箱 📧 发送伪造邮件 – 自定义伪造发件人 ❌ 退出 – 正常退出工具包 （键盘记录器和 IP 更换选项已在 JavaScript 移植版中移除。） 💻 技术栈 语言 ：Node.js...

CVE-2026-31283

CVE-2026-31283 描述 忘记密码功能可被用于对受害者邮箱发起邮件炸弹攻击。 CVSS 3 分数：7.5 高危 攻击类型 远程（未认证） 受影响版本 版本早于或等于 19.1.5 产品供应商 Totara 受影响产品代码库 Totara LMS 受影响组件 忘记密码 API。 缓解措施 对忘记密码 API 实施速率限制。 漏洞详情 忘记密码 API 未对目标电子邮件地址实施速率限制，该漏洞可被用于邮件炸弹攻击。 已修复版本 高于 19.1.5 的版本 发现者： Yazan Abu-Nadi...

CVE-2025-54321

CVE-2025-54321 重置密码邮件轰炸 描述 重置密码功能未对目标电子邮件地址实施速率限制。这可能导致邮件轰炸攻击 CVSS 评分：7.1（高危） 攻击类型 远程（已认证） 受影响版本 版本 8.6.8 发现者 Yazan Abu-Nadi...

CVE-2025-54320

CVE-2025-54320 邀请用户邮件轰炸 描述 邀请API未对目标电子邮件地址实施速率限制。这允许进行邮件轰炸攻击。 CVSS评分：7.1（高） 攻击类型 远程（已认证） 受影响版本 版本 8.6.8 发现者： Yazan Abu-Nadi...

EmBomber

EmBomber 用于邮件轰炸的Python脚本，支持Gmail、Yahoo、Hotmail/Outlook 由Mazen Elzanaty用 制作 功能 支持 Gmail 支持 Yahoo 支持 Hotmail/Outlook 使用方法 EmBomber 应可在所有运行 Python 2.7 的 Linux 发行版上工作。 首先，在终端中输入以下命令克隆它： git clone https://github.com/MazenElzanaty/EmBomber.git 现在导航到 EmBomber 目录： cd EmBomber 现在你可以运行 EmBomber： python...

CVE-2026-100192

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

EUVD-2026-87253

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-100192

X-SpringBoot versions through 6.0 are vulnerable to credential exposure via the GET /application/manager/select endpoint. The root cause is a lack of authentication and field filtering , allowing unauthenticated attackers to retrieve appKey and appSecret credentials. Successful exploitation enabl...

CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

TBomb

TBomb v2.1b 無料でオープンソースのSMS/通話爆撃アプリケーション お知らせ 重要なお知らせ: 低品質なコントリビューション、スパムのプルリクエスト/イシュー、そして新しいプロジェクトへの移行に伴い、このリポジトリをアーカイブすることを決定しました。このプロジェクトは私の最大のサイドプロジェクトの一つであり、これまで受けたすべてのサポートに深く感謝しています。しかし、維持管理がますます困難になり（スパムPR対応をしてくれた@0n1cOn3に特別な感謝を）、これ以上貢献を続ける余裕がなくなりました。...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

CVE-2026-100192: Missing Authentication for Critical Function

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-69183

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183

Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

PT-2026-79066

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183: Authentication Bypass by Spoofing

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...