Whoisleak

Whoisleak This tool queries the emails that registered the domain and verifies if they were leaked in some data leak. To install $ apt-get install nodejs-legacy $ pip install -r requirements.txt Usage Example python whoisleak.py -u securityattack.com.br Contact / Blog Eddy Oliveira SecurityAttack...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - Divulgación de información de usuarios Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2026-53959 Descargo de responsabilidad Este proyecto se proporciona únicamente con fines educativos y para pruebas de seguridad autorizadas. No lo...

CVE-2023-5612

Divulgación del correo electrónico público en el feed RSS de etiquetas https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was...

CVE-2023-6444-POC

CVE-202306444-POC Prueba de concepto sobre la divulgación de correo electrónico de administrador sin autenticación CVE-2023-6444 Uso: python3 cve-2023-6444.py $URL https://vulners.com/cvelist/CVELIST:CVE-2023-6444...

CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Exposición pública de direcciones de correo electrónico de usuarios CVE-2025-59843 Alcance / Aplicación afectada: FlagForge Web Application Endpoint de API: /api/user/username Detalles: El endpoint devuelve las direcciones de correo electrónico de los usuarios...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2026-92594

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-89030

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser in includes/Tools.php, which returns the email address of every...

CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-90934

EspoCRM before 10.0.4 is affected by a field-level security bypass in the meeting and call attendees endpoints. The root cause is incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions, allowing authenticated users to recover restricted email ad...

CVE-2026-86407

The User Registration & Membership WordPress plugin in versions before 5.2.8 contains an unauthenticated user data disclosure vulnerability. The plugin fails to verify if a visitor requesting the membership confirmation page owns the account specified in the request or if a valid registration/pur...

CVE-2026-78152

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

EUVD-2026-76809

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152

The SureRank SEO WordPress plugin, versions 1.6.2 through 1.10.0 , contains a vulnerability that allows unauthenticated visitors to obtain the registered account email addresses of users who have published content. This occurs because the plugin fails to exclude these email addresses from the str...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

PT-2026-90563

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

GHSA-CQR2-H44G-V75V n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

JetBrains YouTrack < 2026.2.18769 Information Disclosure (CVE-2026-86496)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18769. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

EUVD-2026-75137

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...