pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 계정 선점 하이재킹 PocketBase 인증 컬렉션에서 OAuth2가 활성화되면 클라이언트가 가입 시 createData 객체를 전달할 수 있습니다. createData 안의 이메일은 OAuth2 제공자가 확인한 이메일과 비교되지 않습니다. 구성된 제공자에 계정이 있는 사람은 자신의 OAuth2 ID에 연결된 타인의 이메일을 포함하는 레코드를 등록할 수 있습니다. 하나의 제공자가 구성된 경우 실제 소유자는 잠깁니다. 두 개 이상인 경우 소유자는 나중에 다른 제공자를 ...

CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-86552

CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...

EUVD-2026-83648

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2023-6444-POC

CVE-202306444-POC 認証されていない管理者メール開示CVE-2023-6444の概念実証 使用方法: python3 cve-2023-6444.py $URL https://vulners.com/cvelist/CVELIST:CVE-2023-6444...

spyder-osint

Spyder🕷 Spyder is a universal open-source intelligence OSINT research tool that performs searches using large global databases. Features 1. Phone number information 2. IP address information 3. SocialsFacebook, Instagram, Telegram, Twitter information 4. Email information & Email bomber 5. Person...

CVE-2025-29471

Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ▶️ PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2025-43920

CVE-2025-43920: GNU Mailman 2.1.39（cPanel/WHMバンドル）におけるメール件名を介したコマンドインジェクション 発見者: Firudin Davudzada & Musazada Aydan 開示日: 2025年4月 CVE ID: CVE-2025-43920 深刻度: 5.4 中程度 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N 攻撃タイプ: リモート 影響を受けるソフトウェア: GNU Mailman 2.1.39（cPanel/WHMにバンドル） 概要 GNU Mailman...

Exploit for CVE-2026-81294

abraxaslabs.tech · github.com/abraxas ·&...

rspamd v4.2.0

Introduction Rspamd is an advanced spam filtering system and email processing framework that allows evaluation of messages by a number of rules including regular expressions, statistical analysis and custom services such as URL black lists. Each message is analysed by Rspamd and given a verdict...

CVE-2024-13513.py

사용법 기본 사용법 bash python3 exploit.py -l targets.txt -e [email protected] 고급 사용법 bash python3 exploit.py -l targets.txt -e [email protected] -t 100 -o /path/to/results 매개변수 설명 매개변수| 설명| 필수| 기본값 ---|---|---|--- -l, --list| 대상 URL이 포함된 파일 경로| ✅ 예| - -e, --email| 비밀번호 재설정을 위한 이메일 주소| ✅ 예| - -...

phishing-frenzy

Phishing Frenzy Ruby on Rails Phishing Framework Documentation & Info Relevant up to date documentation can be found on the official Phishing Frenzy website located below Phishing Frenzy Website Please submit any tickets or issues to the github issues page Phishing Frenzy Tickets To contact us...

CVE-2024-0235-PoC

CVE-2024-0235-PoC EventON WordPressプラグイン 4.5.5以前、およびEventON WordPressプラグイン 2.2.7以前には、AJAXアクションに認可がなく、認証されていないユーザーがブログ上の任意のユーザーのメールアドレスを取得できます。 使用方法: root@kitploit: usage: CVE-2024-0235.py -h --url URL CVE-2024-0235.py: error: the following arguments are required: --url/-u...

CVE-2023-3128

CVE-2023-3128 CVE-2023-3128（Azure AD のメールクレーム検証に起因する Grafana の認証バイパス）に対して、ドメインが脆弱かどうかを確認するには、次の Python スクリプトを使用できます。 !/usr/bin/env python3 import requests import argparse def checkcve20233128targeturl, verbose=False: """Check for CVE-2023-3128 vulnerability""" session = requests.Session...

Project-NTLM-Hash-Capture-and-Phishing-Email-Exploitation-for-CVE-2024-21413

Project Goal: 이 프로젝트는 네트워크 상의 사용자로부터 NTLM 해시를 캡처하고 이메일을 사용한 피싱 공격을 실행하기 위한 다양한 도구의 사용을 시연하기 위해 만들어졌습니다. 이를 통해 네트워크 인증 취약점과 피싱 방법이 어떻게 시스템을 손상시키기 위해 악용될 수 있는지 보여줍니다. Process Description 1. Responder를 사용한 NTLM 해시 캡처 처음에는 Responder 도구를 사용하여 네트워크를 통해 인증 해시를 캡처했습니다. Responder는 LLMNR, NBT-NS, MDNS와 같은...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ ブラインドSQLインジェクション 必須条件 sqlmapがインストールされていることと、subscriber+権限を持つ有効なユーザー名とパスワードが必要です。 使用方法 root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w...

CVE-2024-25412

CVE-2024-25412 Flatpress v1.3 のクロスサイトスクリプティング XSS 脆弱性により、攻撃者が email フィールドに注入した細工されたペイロードを介して、任意の Web スクリプトまたは HTML を実行できる可能性があります。 脆弱性の種類: クロスサイトスクリプティング XSS 製品ベンダー: https://github.com/flatpressblog/flatpress 影響を受ける製品コードベース 影響を受けるバージョン: FlatPress 1.2.1 最新版 - FlatPress バージョン 1.3 で修正予定。...