CVE-2024-30270-PoC

Este script está diseñado para explotar vulnerabilidades en una instancia de Mailcow usando Cross-Site Scripting XSS y Remote Code Execution RCE. El script tiene como objetivo: Inyectar un payload XSS en la interfaz web de Mailcow. Usar el payload XSS para ejecutar acciones no autorizadas. Lograr...

CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

CVE-2026-90944

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

EUVD-2026-77711

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-90944

Krayin CRM through version 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without requiring authentication. An unauthenticated attacker can supply crafted RFC 2822 messages with forged sender information and headers to inject arbitrary emails into the CRM inbox, including replies to ex...

CVE-2026-90944: Missing Authentication for Critical Function

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-79621

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

EUVD-2026-69845

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621

The CatalogX WordPress plugin (versions before 6.1.3 ) is vulnerable to an Unauthenticated Email Content Injection due to a lack of proper sanitization and escaping of user-supplied content. An unauthenticated attacker can store malicious content that is later included in product enquiry notifica...

WordPress CatalogX plugin < 6.1.3 - Unauthenticated Email Content Injection vulnerability

Unauthenticated Email Content Injection vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Product Catalog Enquiry for WooCommerce by MultiVendorX versions 6.1.3...

CVE-2026-79621: Insufficient Verification of Data Authenticity

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

PT-2026-78452

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contact id offer / contact id event instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...

EUVD-2026-57177

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...