holehe

Holehe OSINT - 이메일로 등록된 계정 찾기 👋 안녕하세요! 전문적인 문의나 협업이 필요하시면 다음 주소로 연락해 주세요: [email protected] 📧 가급적 전문 이메일을 사용해 주세요. 짧고 간결하게, 그리고 모두 영어로 부탁드립니다! Holehe 온라인 버전 요약 이메일에서 등록된 계정을 효율적으로 찾습니다. Holehe는 twitter, instagram, imgur 등 120개 이상의 사이트에서 이메일이 계정에 연결되어 있는지 확인합니다. 비밀번호 찾기 기능을 사용해 정보를 가져옵니다. 대상...

CVE-2024-9441

CVE-2024-9441 漏洞描述： 该代码利用了一个由于基于PHP的Web应用中输入清理不当导致的远程代码执行（RCE）漏洞。具体弱点存在于“忘记密码”功能（index.php?c=user&m=forgotpassword）中，用户输入未经过适当清理，允许攻击者向服务器注入任意PHP代码。 该脚本利用基于PHP的应用中的漏洞，向服务器上传恶意PHP脚本，并通过HTTP请求执行系统命令。 使用步骤： python exploit.py "/bin/ls -al /var/www/html" 如果利用成功，您应在终端输出中看到目录内容。...

CVE-2024-34582

CVE-2024-34582 Mozilla および Chrome Web ブラウザ、Sunhillo Rici5k と Sureline の最新バージョンに影響 Sunhillo デバイス上で実行されている最新バージョンの Web サーバーは、Reflected XSS の影響を受けやすくなっています。この脆弱性は、/cgi/usrPasswd.cgi 内の useridchange パラメータに存在します。このパラメータは、ユーザーが Web サーバーの「Forgot Password」機能を使用してパスワードを変更しようとすると、HTML タグの値にコピーされます。...

Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

Flowise-CVE-2025-58434-PasswordReset

CVE-2025-58434 — Flowise AI 未认证密码重置 概述 CVE ID： CVE-2025-58434 受影响软件： Flowise AI 受影响版本： = 3.0.5 修复版本： 3.0.6 及更高版本 严重程度： 严重 作者： arensballiu 日期： 2025 描述 Flowise AI 3.0.5 及之前版本在密码重置流程中存在身份验证缺陷。/api/v1/account/forgot-password 端点在其 API 响应中直接返回临时重置令牌（tempToken），而无需任何形式的事先身份验证或电子邮件验证。...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 사용자 이름 열거 PoC Silverpeas 버전 6.4.1 및 6.4.2의 사용자 이름 열거 취약점을 시연하는 개념 증명 스크립트입니다. 취약점 세부 정보 영향받는 소프트웨어: Silverpeas 영향받는 버전: 6.4.1, 6.4.2 및 잠재적으로 이전 버전 수정된 버전: 6.4.3 취약점 유형: 관찰 가능한 응답 차이를 통한 사용자 이름 열거 CWE-204 공급업체 추적 ID: Silverpeas Bug 14829 요약: 이 취약점은 비밀번호 찾기 기능...

CVE-2025-58434_CVE-2025-59528

CVE-2025-58434CVE-2025-59528 PoC Script CVE-2025-58434 Flowise -lp...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise Password Reset Account Takeover ATO For research and testing purposes only! I am not responsible for any damages to live infrastructure if this tool is not used as intended. Only use on systems you own or have permission to be testing! Usage root@kitploit: usage:...

CVE-2026-31283

CVE-2026-31283 説明 パスワード忘れを利用して、被害者のメールアドレスにメール爆撃攻撃を仕掛けることができます。 CVSS 3 スコア: 7.5 High 攻撃タイプ リモート（認証不要） 影響を受けるバージョン バージョン 19.1.5 以前 ベンダー Totara 影響を受ける製品コードベース Totara LMS 影響を受けるコンポーネント パスワード忘れ API。 緩和策 パスワード忘れ API にレート制限を実装する。 脆弱性の詳細 パスワード忘れ API...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak 忘记密码流程认证绕过 PoC 针对 CVE-2026-18963 的概念验证，该漏洞存在于 Keycloak 的“忘记密码”/凭据选择流程中，攻击者可借此到达 UPDATEPASSWORD 步骤——并重置目标账户的密码——而无需正确完成所需的身份验证（例如，无需有效的 OTP/第二因素）。 该脚本完全通过 HTTP 驱动整个流程（无需浏览器/Selenium），具体步骤如下： 1. 加载领域的登录页面并定位“忘记密码”链接。 2. 打开重置凭据页面并触发 tryAnotherWay。 3. 在生成的凭据选择器中提交用户名。 4. 提取并...

CVE-2025-58434-PoC

CVE-2025-58434 PoC Python proof-of-concept script for triggering POST /api/v1/account/forgot-password. ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Credit zaddy6 Isaac David arthurgervais...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Flowise = 3.0.5에 영향을 미치는 두 가지 취약점에 대한 익스플로잇 체인입니다. 취약점 CVE-2025-58434 — 인증되지 않은 계정 탈취 비밀번호 찾기 엔드포인트는 인증 없이 API 응답에 유효한 비밀번호 재설정 토큰을 반환합니다. 유효한 이메일 주소를 알고 있는 공격자는 사용자 상호작용 없이 모든 계정의 비밀번호를 재설정할 수 있습니다. CVE-2025-59528 — 인증된 원격 코드 실행 CustomMCP 노드는 사용자 제어 입력을 전체 Node.js...

CVE-2026-86452

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...

CVE-2026-86452 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...

CVE-2026-81033

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

EUVD-2026-66609

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-81033

Automatisch (through v0.15.0 ) exposes a user enumeration vulnerability through its forgot-password endpoint. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js returns a not-found status for unregistered addresses but a no-content status for registered on...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

PT-2026-82221

Name of the Vulnerable Software and Affected Versions Automatisch affected versions not specified Description An information disclosure issue exists in the forgot-password functionality. The endpoint '/api/v1/users/forgot-password' allows an unauthenticated user to determine if a specific address...