anti-anti-automation

إطار عمل مضاد لمكافحة الأتمتة إطار عمل لتقنيات تجاوز ضوابط الأمن الشائعة لمكافحة الأتمتة. ضوابط مكافحة الأتمتة الشائعة التحقق من البريد الإلكتروني CAPTCHA SMS/الهاتف بطاقة الائتمان WASC-21: عدم كفاية مكافحة الأتمتة http://projects.webappsec.org/w/page/13246938/Insufficient%20Anti-automation WE-79...

CVE-2021-34646

CVE-2021-34646 PoC detalhe desta vulnerabilidade pelo NVD Versões até a 5.4.3, inclusive, do plugin Booster for WooCommerce para WordPress são vulneráveis a bypass de autenticação através da função processemailverification devido a uma fraqueza na geração de token aleatório na função...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 La vulnerabilità è stata causata da un bug nel modo in cui GitLab gestiva la verifica dell'email durante la reimpostazione della password. Un attaccante poteva fornire due indirizzi email durante una richiesta di reimpostazione della passwo...

CVE-2024-24139

CVE-2024-24139: SQL-Injection im Anmeldesystem mit E-Mail-Verifizierung Nachweis des Konzepts PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md Nachweis des Konzepts PoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

CVE-2026-77508

Weblate , a web-based localization tool, is affected by an unverified email-change vulnerability prior to version 2026.8 . An authenticated user can modify their primary email via PUT or PATCH requests to /api/users/{username}/ without the new address being verified. This allows a subsequent team...

osint-tools-mcp-server

🔍 Servidor MCP de Ferramentas OSINT Um servidor MCP abrangente que expõe múltiplas ferramentas OSINT para assistentes de IA como Claude. Este servidor permite que a IA realize tarefas sofisticadas de reconhecimento e coleta de informações usando ferramentas OSINT padrão da indústria. 🛠️ Ferramenta...

poastal

Poastal - lo strumento OSINT per Email Poastal è uno strumento OSINT per email che fornisce informazioni preziose su qualsiasi indirizzo email. Con Poastal, puoi facilmente inserire un indirizzo email e risponderà rapidamente a diverse domande, fornendoti informazioni cruciali. ✨ Caratteristiche...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

EUVD-2026-36714

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak-Reset-Credentials-Bypass → Kontenübernahme Unauthentifizierte Kontenübernahme im Reset-Credentials-Ablauf von Keycloak. Ein Angreifer, der nur einen Benutzernamen/eine E-Mail-Adresse kennt, kann das Passwort eines beliebigen Benutzers zurücksetzen — einschließlich...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-64224

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

VulnCheck KEV: CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...