osint-tools-mcp-server

🔍 Serveur MCP d'outils OSINT Un serveur MCP complet qui expose plusieurs outils OSINT aux assistants IA comme Claude. Ce serveur permet à l’IA d’effectuer des tâches sophistiquées de reconnaissance et de collecte d’informations à l’aide d’outils OSINT standard de l’industrie. 🛠️ Outils disponibles...

CVE-2024-24139

CVE-2024-24139: ثغرة حقن SQL في نظام تسجيل الدخول مع التحقق من البريد الإلكتروني إثبات المفهوم PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md إثبات المفهوم PoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

poastal

Poastal - أداة OSINT للبريد الإلكتروني Poastal هي أداة OSINT للبريد الإلكتروني توفر معلومات قيّمة عن أي عنوان بريد إلكتروني. باستخدام Poastal، يمكنك بسهولة إدخال عنوان بريد إلكتروني وستجيب بسرعة عن عدة أسئلة، مما يوفر لك معلومات حاسمة. ✨ الميزات تحديد اسم الشخص الذي يمتلك البريد الإلكتروني. التحق...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 La vulnérabilité a été causée par un bug dans la manière dont GitLab gérait la vérification des e‑mails lors de la réinitialisation du mot de passe. Un attaquant pouvait fournir deux adresses e‑mail lors d’une demande de réinitialisation de...

CVE-2026-107120

The Contest Gallery WordPress plugin, in versions prior to 33.0.1 , is vulnerable to an unauthenticated email verification bypass. The root cause is a failure to limit the number of attempts against the front-end registration email-verification step, which utilizes a short numeric PIN . An attack...

CVE-2026-107120 Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...

anti-anti-automation

Framework Anti-Anti-Automatisation Un framework de techniques permettant de contourner les contrôles de sécurité anti-automatisation courants. Contrôles anti-automatisation courants Vérification par e-mail CAPTCHA SMS/Téléphone Carte de crédit WASC-21: Anti-automatisation insuffisante...

CVE-2026-18963

CVE-2026-18963 — Laboratoire de contournement du flux de réinitialisation des identifiants Keycloak Aperçu Laboratoire simulant la vulnérabilité CVE-2026-18963 CVSS 9.1 dans Keycloak, permettant à un attaquant de prendre le contrôle de n'importe quel compte via un contournement de la vérification...

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

CVE-2026-106460

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

CVE-2026-106460 Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

CVE-2026-106460

The @backstage/plugin-auth-node package in the Backstage framework (versions 0.3.0 through 0.6.15 and 0.7.5) fails to consistently honor explicit negative email verification during shared OAuth profile normalization. Specifically, it may ignore verified: false or email_verified: false claims in c...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

PT-2026-107263

Name of the Vulnerable Software and Affected Versions Backstage versions 0.3.0 through 0.6.14 Backstage versions 0.7.0 through 0.7.4 Description The @backstage/plugin-auth-node package fails to consistently honor explicit negative email verification during shared OAuth profile normalization. This...

CVE-2021-34646

CVE-2021-34646 PoC تفاصيل هذه الثغرة الأمنية حسب NVD الإصدارات حتى 5.4.3 وما يشملها من إضافة Booster for WooCommerce لـ WordPress معرضة لتجاوز المصادقة عبر دالة processemailverification بسبب ضعف في توليد الرمز العشوائي في دالة resetandmailactivationlink الموجودة في ملف...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA（WordPress 插件 miniorange-2-factor-authentication）≤ 6.3.0 — 通过电子邮件验证链接（userID / Txid / accessToken）实现未认证的任意 WordPress 选项删除。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。 python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGE...

CVE-2026-92161: Insufficient Verification of Data Authenticity

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

CVE-2026-86552

CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...