gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 Уязвимость была вызвана ошибкой в обработке проверки электронной почты при сбросе пароля в GitLab. Злоумышленник мог указать два адреса электронной почты в запросе на сброс пароля, и код сброса отправлялся на оба адреса. Это позволяло...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

poastal

Poastal - l'outil OSINT pour emails Poastal est un outil OSINT pour emails qui fournit des informations précieuses sur n'importe quelle adresse email. Avec Poastal, vous pouvez facilement saisir une adresse email et il répondra rapidement à plusieurs questions, vous fournissant des informations...

osint-tools-mcp-server

🔍 OSINT Tools MCP Server Полнофункциональный MCP-сервер, предоставляющий AI-ассистентам, таким как Claude, доступ к множеству OSINT-инструментов. Этот сервер позволяет AI выполнять сложные задачи разведки и сбора информации с помощью отраслевых OSINT-инструментов. 🛠️ Доступные инструменты 🔍...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

anti-anti-automation

Фреймворк Anti-Anti-Automation Фреймворк, содержащий техники обхода типовых средств контроля безопасности от автоматизации. Распространённые средства защиты от автоматизации Проверка email CAPTCHA SMS/телефон Кредитная карта WASC-21: Недостаточная защита от автоматизации...

CVE-2026-18963

CVE-2026-18963 — Лаборатория обхода потока сброса учётных данных Keycloak Обзор Лаборатория моделирует уязвимость CVE-2026-18963 CVSS 9.1 в Keycloak, позволяющую злоумышленнику захватить любую учётную запись через обход проверки электронной почты в потоке сброса пароля. Только для целей...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

CVE-2021-34646

CVE-2021-34646 PoC Описание уязвимости от NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink functio...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA плагин WordPress miniorange-2-factor-authentication ≤ 6.3.0 — неаутентифицированное произвольное удаление опций WordPress через ссылку подтверждения email userID / Txid / accessToken. Только для авторизованного тестирования. Не запускайте это...

CVE-2024-24139

CVE-2024-24139: Система входа с проверкой электронной почты SQL-инъекция Доказательство концепции PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md Доказательство концепции PoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

CVE-2026-92161: Insufficient Verification of Data Authenticity

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

EUVD-2026-83648

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-86552

CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...

CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

EUVD-2026-83506

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

PT-2026-95759

Name of the Vulnerable Software and Affected Versions UsersWP versions prior to 1.5.10 Description An issue exists where the plugin fails to verify if a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated...

WordPress SoftMarket plugin <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass vulnerability

Unauthenticated Account Takeover via Email Verification Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin SoftMarket — Digital Marketplace versions = 1.0.0...

WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability

Email Verification Bypass vulnerability discovered by Ahmed Embaby in WordPress Plugin FluentAuth – The Ultimate Authorization & Security Plugin for WordPress versions = 2.1.2...