CVE-2012-2593

Цепочка эксплойтов Atmail XSS-CSRF-RCE PoC atmail-rce.py: Эксплуатирует CVE-2012-2593 в веб-интерфейсе Atmail. atmail-csrf.js: JavaScript-файл, который использует CVE-2012-2593 для CSRF для установки вредоносного плагина, выполняющего обратную оболочку. Plugin.php: Плагин Atmail, который...

CVE-2025-52691-APT-PoC

CVE-2025-52691 PoC：SmarterMail 任意ファイルアップロード RCE（APT強化版） これはCVE-2025-52691 用の拡張された概念実証（PoC）エクスプロイトです。CVE-2025-52691は、SmarterTools SmarterMail...

CVE-2020-14064

Icewarp Email Server 12.3.0.1 incorrectaccesscontrol https://nvd.nist.gov/vuln/detail/CVE-2020-14064...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - Exploit toolchain XSS CSRF RCE PacketStorm WLB-2020080010 Disclaimer: this exploit toolchain was inspired by EDB-ID 20009. Goal The goal of this exploit toolchain is to replace EDB-ID 20009. Pros of this toolchain over EDB-ID 20009 exploit: Simple to use Reusab...

CVE-2020-14066

CVE-2020-14066 Icewarp Email Server 12.3.0.1 небезопасные разрешения https://nvd.nist.gov/vuln/detail/CVE-2020-14066...

CVE-2020-14065

CVE-2020-14065 Icewarp Email Server 12.3.0.1 unlimitedfileupload https://nvd.nist.gov/vuln/detail/CVE-2020-14065...

CVE-2020-14066

Icewarp Email Server 12.3.0.1 insecurepermissions https://nvd.nist.gov/vuln/detail/CVE-2020-14066...

CVE-2020-14065

Icewarp Email Server 12.3.0.1 unlimitedfileupload https://nvd.nist.gov/vuln/detail/CVE-2020-14065...

EUVD-2026-67673

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

CVE-2026-78498

CVE-2026-78498 is a server-side request forgery (SSRF) vulnerability in the WatchGuard Dimension Email Server Test configuration . An authenticated privileged attacker can use this flaw to enumerate exposed network services on adjacent network systems . The CVSS 4.0 score is 5.1 (Medium) , reflec...

CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

GHSA-F965-GHFW-X6JX vulnerabilities

Vulnerabilities for packages: exim...

PT-2026-78836

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-755AP versions prior to 20260702 Description A command injection flaw exists in the ssi component within the /cgi-bin/email.cgi endpoint. The issue resides in the log email server function, allowing a remote attacker to execute...

CVE-2026-62913 Microsoft Exchange Server Remote Code Execution Vulnerability

...

EUVD-2026-53317

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

Alt-N MDaemon 20.0.x < 20.0.9 / 21.0.x < 21.0.8 / 21.5.x < 21.5.6 / 22.0.x < 22.0.7 / 23.0.x < 23.0.4 / 23.5.x < 23.5.5 / 24.0.x < 24.0.4 / 24.5.x < 24.5.3 / 25.0.x < 25.0.3 Stored XSS

The remote Windows host is running a version of MDaemon Email Server that is affected by a stored cross-site scripting XSS vulnerability. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript cod...

EUVD-2026-45012

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

EUVD-2026-42057

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an...

CVE-2026-13020

CVE-2026-13020 affects Esri Portal for ArcGIS up to version 12.1 on Windows, Linux, and Kubernetes. A weak password-recovery mechanism lets a remote, unauthenticated attacker potentially take ownership of a user account by manipulating the recovery flow. The vulnerability’s impact is described as...

PT-2026-56205

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.2 Description A weak password recovery mechanism for forgotten passwords allows a remote, unauthorized attacker to assume ownership of a user account by manipulating the recovery process...