CVE-2026-84465

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465

The open source helpdesk system Zammad is vulnerable to sender impersonation in versions prior to 7.1.2 . The root cause is that the system fails to verify if an S/MIME-signed email's certificate is genuinely trusted; instead, it only checks if a certificate with a matching name exists in the sys...

EUVD-2026-87265

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

EUVD-2026-43026

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...

CVE-2026-56223 Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a...

Dokploy Trust Management Vulnerability

Dokploy is an open-source software developed by Dokploy itself. Versions of Dokploy from 0.27.0 to 0.29.3 had a security vulnerability related to trust management. This vulnerability stemmed from a hardcoded BETTERAUTHSECRET fallback value, which allowed unauthorized attackers to forge email-base...

CVE-2026-29142: Missing Cryptographic Step

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email...

EUVD-2000-0385

Malware in sbrugna...

Mattermost: ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNT

A vulnerability was found in a website that allowed an attacker to trick a victim into using a crafted email address for a particular session, leading to the attacker taking back the victim's account and accessing their private messages. The vulnerability was triggered by removing the email value...

Matrix Synapse Cross-Site Script Vulnerability

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability was previously present in Matrix Synapse version 1.27.0, which allowed an attacker to exploit the vulnerability to insert forged content into an email message...

CVE-2020-5767

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35448)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, 3.7.5 and 3.6.7. An attacker can exploit the vulnerability to add a forged link to an email notification...

PT-2018-2720

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.5.1 Description A flaw in the verification of certain S/MIME signatures in Thunderbird causes emails to be displayed as having a valid digital signature, even if the message contents are not covered by the...

CVE-2018-1000025

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

HiFriend - 'cgi-bin/hifriend.pl' Open Email Relay

source: https://www.securityfocus.com/bid/30320/info HiFriend is prone to an open-email-relay vulnerability. An attacker could exploit this issue by constructing a script that would send unsolicited bulk email to an unrestricted amount of email addresses with a forged email address. !/usr/bin/per...

Webbler CMS 3.1.3 - Mail A Friend Open Email Relay

source: https://www.securityfocus.com/bid/25045/info The 'webbler' is prone to an open-email-relay vulnerability. An attacker may leverage the issue to use webservers that are hosting the vulnerable software to send arbitrary unsolicited bulk email. Attackers may also forge email messages that...

CVE-2000-1203

Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of service CPU consumption by forging an email message with the sender as [email protected] localhost, which causes Domino to enter a mail loop...

CVE-2000-0386

The CVE-2000-0386 entry concerns FileMaker Pro 5 Web Companion, where remote attackers can send anonymous or forged email. The provided documents confirm this description but do not include deeper root-cause, affected versions, exploit details, or remediation. No explicit fix/version information ...