432 matches found
CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability
CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability 此脚本提供了针对 CVE-2024-21413 的概念验证（PoC），该漏洞是 Microsoft Outlook 中发现的一个严重安全漏洞，CVSS 评分为 9.8。此漏洞被称为 MonikerLink 错误，具有广泛的影响，包括潜在的本地 NTLM 凭据泄露以及远程代码执行的可能性。 🚀 用法 请负责任地使用此工具，并确保已获得目标系统所有者的授权。该脚本需要 SMTP 身份验证来发送电子邮件，绕过 SPF、DKIM 和 DMARC...
Email-Vulnerability-Checker
Email Vulnerability Checker v2.1 ドメインがなりすましに対して脆弱かどうかをEmail-vulnerablity-checkerで確認します バージョン2.1の機能 -o フラグを使用して出力をファイルに保存する機能を追加 脆弱性ステータスを正確に通知するためのチェックを追加 コードを完全に更新し、適切かつ正確な結果を提供 ツールの外観を強化し、一部のルックアンドフィールを改善 Email Vulnerability Checker...
CVE-2023-7028-GitLab
GitLab-CVE-2023-7028 示例 python3 attack.py -u http://TargetIP:8000 -t [email protected] -e [email protected]...
EUVD-2026-54448
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...
CVE-2026-38444
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...
WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection vulnerability
Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin Contact Form by WPForms versions = 1.10.2...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +139 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =0.0.21 and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342526...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +138 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.7)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =0.0.21 and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342524...
EUVD-2026-32678
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...
The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the execution of operations beyond the buffer in memory, allowing an attacker to execute arbitrary code.
The vulnerability in Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
SUSE CVE-2026-48846
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var value in an e-mail message, which may lead to information disclosure or access-control bypass...
CVE-2026-48846
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var value in an e-mail message, which may lead to information disclosure or access-control bypass...
EUVD-2026-31725
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var value in an e-mail message, which may lead to information disclosure or access-control bypass...
CVE-2026-48846
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var value in an e-mail message, which may lead to information disclosure or access-control bypass...
Open-Xchange OX Dovecot Pro 访问控制错误漏洞
Open-Xchange OX Dovecot Pro is an email storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a access control vulnerability. This vulnerability stems from the IMAP SETACL command, which allows the anyone permission to be injected into the user’s...
Arbitrary Code Injection
Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the compose email...
CVE-2026-36340
Krayin CRM v.2.1.5 is vulnerable to Remote Code Execution (RCE) via the Email $\rightarrow$ Compose feature. The application fails to perform sufficient validation—such as extension checks, MIME type verification, or executable file restrictions—when processing attachments for the POST /admin/mai...
CVE-2026-41426
CVE-2026-41426 affects pretalx (prior to 2026.1.0). An unauthenticated attacker can inject arbitrary HTML-rendered emails by embedding malformed HTML or markdown in a user-controlled template placeholder (e.g., account display name). The most direct vector is the password-reset flow: attacker cre...
WordPress plugin Responsive Blocks – Page Builder for Blocks & Patterns 输入验证错误漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
