Project-NTLM-Hash-Capture-and-Phishing-Email-Exploitation-for-CVE-2024-21413

Project Goal: The project was created to demonstrate the use of various tools for capturing NTLM hashes from users on a network and for executing phishing attacks using email. This showcases how network authentication vulnerabilities and phishing methods can be exploited to compromise systems...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Inyección SQL ciega de Subscriber+ Requisitos sqlmap instalado y un nombre de usuario y contraseña válidos con subscriber+ Uso root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show th...

CVE-2024-25412

CVE-2024-25412 A cross-site scripting XSS vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field Vulnerability Type: Cross Site Scripting XSS Vendor of Product: https://github.com/flatpressblog/flatpress Affect...

CVE-2024-34327

CVE-2024-34327 SQL Injection Vulnerability Checker This script V-24-02-001SQLiCheck.py is a proof-of-concept PoC tool to verify the presence of a time-based blind SQL injection vulnerability affecting the password-reset-token.php endpoint, identified as CVE-2024-34327. ⚠️ Disclaimer This tool is...

CVE-2012-2593

Atmail XSS-CSRF-RCE Exploit Chain PoC atmail-rce.py: Exploits CVE-2012-2593 in Atmail's webmail interface. atmail-csrf.js: Javascript file which leverages CVE 2012-2593 into a CSRF to install a malicious plugin which executes a reverse shell Plugin.php: Atmail plugin to be installed which calls a...

CVE-2019-18818

CVE-2019-18818 Usage : url Reference : https://vulners.com/cve/CVE-2019-18818 https://thatsn0tmysite.wordpress.com/2019/11/15/x05/...

CVE-2026-90537

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...

EUVD-2026-76855

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...

CVE-2026-90537

CVE-2026-90537 affects WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) in the file plugin/Scheduler/sendEmail.json.php . The root cause is a missing authorization check : an unauthenticated attacker can access scheduler email jobs by supplying any valid site-wide daily token...

CVE-2025-4796

CVE-2025-4796 Eventin Una vez que el correo electrónico se cambia a una d...

CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Exposición pública de direcciones de correo electrónico de usuarios CVE-2025-59843 Alcance / Aplicación afectada: FlagForge Web Application Endpoint de API: /api/user/username Detalles: El endpoint devuelve las direcciones de correo electrónico de los usuarios...

CVE-2023-23397-POC

CVE-2023-23397-POC Simple PoC for CVE-2023-23397 vulnerability, payload sent via email...

CVE-2026-78152

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

EUVD-2026-76809

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152

SureRank SEO WordPress plugin versions 1.6.2 through 1.10.0 fail to exclude registered account email addresses from the Person Schema structured data it outputs on public pages by default. This allows unauthenticated visitors to enumerate the email addresses of any user who has published content,...

SharpExchange

SharpExchange Este POC de línea de comandos demuestra cómo se puede usar C para interactuar con Microsoft Exchange EWS, mostrando que puede hacerse con otras herramientas además de PowerShell. Sí, es un POC simple para mostrar cómo podría hacerse. No es 100%. Si quieres lucir tus habilidades l33t...

CVE-2023-23397

CVE-2023-23397 Escalada de Privilegios en Outlook Prueba de concepto para CVE-2023-23397 en Python Prueba de concepto rápida y sencilla en Python para la CVE de Outlook que afecta a los productos Microsoft Office/365. Uso 1. Instala pywin ejecutando pip install pywin32 2. Inicia un servidor SMB e...

Roundcube-CVE-2024-42008-POC

CVE-2024-42008 RoundCube XSS Exploit Overview This repository contains a proof-of-concept exploit for CVE-2024-42008 , a Cross-Site Scripting XSS vulnerability in RoundCube webmail application. This exploit is designed for educational purposes and controlled penetration testing environments like...

CVE-2023-7028

CVE-2023-7028 | Toma de control de cuenta en GitLab Descargo de responsabilidad Este código es una prueba de concepto de la vulnerabilidad. No animo a nadie a usarlo en instancias de GitLab que no le pertenezcan. Esta herramienta ha sido desarrollada únicamente con fines de investigación y...