51681 matches found
CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...
CVE-2026-81905
Concrete CMS versions below 9.5.3 store user validation hashes (email/registration validation, password reset, persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone without verifying its type . This allows a long-lived registration hash (60...
Email_Extract_Gmass.co_Validator
EmailExtractGmass.coValidator Python 2.7 该工具运行时间会很长，因为网站太慢，请耐心等待。 捐赠： BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...
CVE-2025-24000-exploit
CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Overview This script exploits CVE-2025-24000 , a high-severity broken access control vulnerability in the Post SMTP WordPress plugin versions ≤ 3.2.0. It allows any authenticated user with a low-privilege account e.g. Subscriber to access th...
GHSA-CQR2-H44G-V75V n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...
OutlookLeakTest
Outlook HTML 泄漏测试项目！ 博客文章： https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/smb-hash-hijacking-and-user-tracking-in-ms-outlook/ "./Schemes-List.xlsx" 中有什么？ 可在 Windows 中生效的 URI 方案列表。这些方案/协议在类似的研究中可能有助于发现新漏洞或绕过现有防护。其他产品也可能受到类似影响，但此处未对此进行研究。 有意思的是，使用 MS Office...
CVE-2026-28289
🚨 CVE-2026-28289 — “Mail2Shell” 通过邮件附件绕过实现 FreeScout 零点击未授权 RCE 📖 概述 CVE-2026-28289 ，别名为 Mail2Shell ，是一个影响 FreeScout 的严重零点击远程代码执行（RCE）漏洞。 攻击者可以向 FreeScout 邮箱发送一封特制邮件，从而在无需身份验证、无需用户交互的情况下获得底层服务器的远程 shell 访问权限 。 🧠 漏洞摘要 字段| 值 ---|--- CVE ID| CVE-2026-28289 严重程度| 🔴 严重 CVSS| 10.0（最高） 攻击向量| 远程（邮件）...
responsible-disclosure-email-gathering
Recopilación de Correos Electrónicos de Divulgación Responsable Propósito Es posible que hayas encontrado una vulnerabilidad en un host, pero dicho host/organización no tiene un programa activo en HackerOne o BugCrowd. Si este es el caso, ¡este flujo de trabajo es para ti! En términos generales,...
anti-anti-automation
Anti-Anti-Automation Framework Un framework de técnicas para evadir los controles de seguridad anti-automatización comunes. Controles comunes anti-automatización Verificación de correo electrónico CAPTCHA SMS/Teléfono Tarjeta de crédito WASC-21: Anti-automatización insuficiente...
Johnny-You-Are-Fired
Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...
CVE-2026-7537
MDJM Event Management = 1.7.8.3 - 已认证（管理员及以上）通过 'mdjmemailuploadfile' 参数实现任意文件上传 WordPress MDJM Event Management 插件（1.7.8.3 及更早版本）存在任意文件上传漏洞，允许已认证的管理员向服务器上传恶意 PHP 文件，进而可能导致远程代码执行。 TL;DR 漏洞利用 提供了一个 POC CVE-2026-7537.py，用于演示已认证攻击者上传 shell.php 并执行远程代码： root@kitploit: python3 ./CVE-2026-7537.py...
CVE-2026-18963
CVE-2026-18963 — Keycloak 重置凭据流程绕过实验 概述 本实验模拟 Keycloak 中的 CVE-2026-18963 漏洞（CVSS 9.1），该漏洞允许 攻击者通过绕过密码重置流程中的邮箱验证来接管任意账户。 仅供安全研究和教育目的使用。 环境要求 Docker 与 Docker Compose Python 3.8+ pip 使用说明 1. 启动存在漏洞的 Keycloak root@kitploit: docker-compose up -d 等待 Keycloak 启动（约 30-60 秒）。 2. 配置实验环境 root@kitploit: pip...
CVE-2025-20393
CVE-2025-20393 📌 Overview CVE-2025-20393 is a critical Remote Command Execution RCE vulnerability affecting Cisco Secure Email Gateway SEG and Cisco Secure Email and Web Manager SEWM appliances running Cisco AsyncOS. The vulnerability exists due to improper input validation in the Spam Quarantine...
CVE-2026-88005
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...
CVE-2026-81783
Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...
CVE-2025-63419
CVE-2025-63419 CrushFTP 11.3.760以前のバージョンはHTMLインジェクションに対して脆弱です。Webベースのサーバーにはユーザーがファイルを共有できる機能があり、その機能はファイル名をメール本文フィールドに反映しますが、サニタイズが行われないためHTMLインジェクションにつながります。 CWE CWE-79 — Webページ生成時の入力の不適切な無効化（クロスサイトスクリプティング） CVSS v3.1 基本スコア: 3.5 低 root@kitploit: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N 概要...
CVE-2026-88005 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...
EUVD-2026-75540
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...