CVE-2024-24139

CVE-2024-24139: Login System with Email Verification SQL Injection Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

osint-tools-mcp-server

🔍 OSINT Tools MCP Server A comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude. This server allows AI to perform sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools. 🛠️ Available Tools 🔍 Sherlock - Username Search...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

poastal

Poastal — инструмент OSINT для email Poastal — это инструмент OSINT для email, который предоставляет ценную информацию о любом email-адресе. С помощью Poastal вы можете легко ввести email-адрес, и он быстро ответит на несколько вопросов, предоставив вам важную информацию. ✨ Возможности Определить...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

EUVD-2026-42966

ZITADEL: Auto-linking by email: IdP-side email verification is not checked...

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 Уязвимость была вызвана ошибкой в обработке проверки электронной почты при сбросе пароля в GitLab. Злоумышленник мог указать два адреса электронной почты в запросе на сброс пароля, и код сброса отправлялся на оба адреса. Это позволяло...

anti-anti-automation

안티-안티-자동화 프레임워크 일반적인 안티-자동화 보안 통제를 우회하는 기법을 위한 프레임워크입니다. 일반적인 안티-자동화 통제 이메일 인증 CAPTCHA SMS/전화 신용카드 WASC-21: 불충분한 안티-자동화 http://projects.webappsec.org/w/page/13246938/Insufficient%20Anti-automation WE-799: 부적절한 상호작용 빈도 제어 http://cwe.mitre.org/data/definitions/799.html...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab 개요 Keycloak의 CVE-2026-18963 CVSS 9.1 취약점을 시뮬레이션하는 Lab으로, 공격자가 비밀번호 재설정 흐름에서 이메일 검증을 우회하여 임의의 계정을 탈취할 수 있게 합니다. 보안 연구 및 교육 목적으로만 사용하십시오. 요구 사항 Docker & Docker Compose Python 3.8+ pip 사용 안내 1. 취약한 Keycloak 실행 root@kitploit: docker-compose...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

EUVD-2026-72858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by an authentication bypass rooted in its SQL data layer: sqlDAL caches empty result sets that writeSql never invalidates. As a result, when a user attempts two-factor authentication on a new device, the confirmation code ...

CVE-2021-34646

CVE-2021-34646 PoC Описание уязвимости от NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink functio...

Oracle Linux 8 : ELSA-2026-62407-0: / grafana (ELSA-2026-624070)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-624070 advisory. - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 - Resolves RHEL-219393: CVE-2026-42127 Tenable has extracted t...

CVE-2026-82968 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...

grafana security update

9.2.10-33.0.1 - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 9.2.10-33 - Rebuild against updated golang - Resolves RHEL-251835 - Resolves RHEL-251696 - Resolves RHEL-242383 - Resolves RHEL-242344 - Resolves RHEL-242224 - Resolves RHEL-242108 - Resolves...

PT-2026-84668

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...