chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite putcontents $dir . $name, $item'data' ; The filename ../../plugins/shell.php concatenated with $dir wp-content/uploads/crm-attachments/ resolves to wp-content/plugins/shell.php — a directory...

IMAPLoginTester

IMAPLoginTester IMAPLoginTester is a simple Python script that reads a text file with lots of e-mails and passwords, and tries to check if those credentials are valid by trying to login to the respective IMAP servers. Usage: usage: imaplogintester.py -h -i INPUT -o OUTPUT -s -t SLEEPTIME -T TIMEO...

SharpGmailC2

SharpGmailC2 Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 Gmail via imap protocol DISCLAIMER: This Project doesn't work against Windows Defender after 29th of November, 2022. This tool is now signatured by MS Windows as virtool:msi...

CVE-2020-1349

CVE-2020-1349 This vulnerability occurs in Outlook 2019 16.0.12624.20424 installed on Korean Windows 10 1909 x64, codepage 949. TLDR; I have not been able to bypass aslr using this vulnerability, but I have written an outlook 2019 32bit exploit that pops up a calculator using the address of a...

fapro

FaPro Free,Cross-platform,Single-file mass network protocol server simulator 中文Readme Description FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services. The goal is to support as many protocols as possible, and support as many deep interactions as possible for...

striptls

striptls - auditing proxy poc implementation of STARTTLS stripping attacks A generic tcp proxy implementation and audit tool to perform protocol independent ssl/tls interception and STARTTLS stripping attacks on SMTP, POP3, IMAP, FTP, NNTP, XMPP, ACAP and IRC. Python2! 🏆 Trophies CVE-2016-0772 -...

CVE-2018-19518

CVE-2018-19518 last rapport here : https://gitlab.com/ensimag-security/CVE-2018-19518/-/jobs/artifacts/master/raw/rapport.pdf?job=PDF Usage run app docker-compose up -d example normal usage for the web app. imap : webmail.grenoble-inp.org user : [email protected] password : xxx exploit using...

CVE-2026-115774

A flaw was found in Twisted. An authenticated remote attacker can send a specially crafted search command with a negative size to the Internet Message Access Protocol IMAP service, triggering an infinite processing loop. This flaw leads to a Denial of Service DoS, freezing the application and...

Updated roundcubemail package fixes security vulnerabilities

Fix IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action, reported by Wahab “NeoX” K. Fix bug where an alias login wasn’t qualified by IMAP host, reported by Milan Hoppe. Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. Fix SSRF...

[SECURITY] [DSA 6579-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 23, 2026 https://www.debian.org/security/faq -...

CVE-2026-114720

Fix IMAP command injection via CRLF in flag parameter of mail/mark action...

CVE-2026-114732

Fix bug where an alias login wasnt qualified by IMAP host...

UBUNTU-CVE-2026-114732

Fix bug where an alias login wasnt qualified by IMAP host...

UBUNTU-CVE-2026-114720

Fix IMAP command injection via CRLF in flag parameter of mail/mark action...

Debian dsa-6579 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6579 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/securit...

CVE-2026-114732

A flaw was found in Roundcube Webmail. In multi-host installations, user authentication using an alias address does not restrict account lookup to the specific Internet Message Access Protocol IMAP host. A remote authenticated user could exploit this flaw to gain unauthorized access to another...

CVE-2026-114720

A flaw was found in roundcubemail. This vulnerability allows a remote authenticated attacker to execute arbitrary Internet Message Access Protocol IMAP commands on the connected mail server. The issue exists due to insufficient input validation, which permits the injection of carriage return line...

SUSE CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...