MailRipV2

Mail.Rip V2.1337 Tu verificador SMTP / crackeador SMTP para listas de combinaciones mailpass que incluye características como: soporte de proxy SOCKS4 / SOCKS5 con raspador y verificador automático de proxy, verificación de entrega de correo electrónico / bandeja de entrada y búsqueda DNS para...

CVE-2024-42008-9-exploit

CVE-2024-42008-9-exploit Los scripts en este repositorio están diseñados para explotar CVE-2024-42008 y CVE-2024-42009. Ambas son vulnerabilidades encontradas en Roundcube 1.6.7. Lea más sobre estas CVEs y cómo pueden ser explotadas en el siguiente enlace:...

CVE-2021-33766

POC Exploit CVE-2021-33766 ProxyToken POC Exploit para CVE-2021-33766 ProxyToken es un práctico script de shell que proporciona a pentesters e investigadores de seguridad una forma rápida y eficaz de probar la vulnerabilidad ProxyToken de Microsoft Exchange. Descargo de responsabilidad Este...

CVE-2018-8581

CVE-2018-8581 Se trata de una vulnerabilidad de movimiento lateral y escalada de privilegios a nivel de buzón de correo. Permite, tras contar con las credenciales de una cuenta de correo con permisos normales, realizar la delegación y toma de control de la bandeja de entrada de otros usuarios...

CVE-2018-8581

CVE-2018-8581 Esta es una vulnerabilidad de movimiento lateral y escalada de privilegios a nivel de buzón de correo. Permite, tras obtener las credenciales de una cuenta de correo con permisos normales, tomar el control delegado de la bandeja de entrada de otros usuarios incluidos administradores...

CVE-2026-104463

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

CVE-2026-104463 YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

CVE-2026-104463 YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

EUVD-2026-91474

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

CVE-2026-104463

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can trigger server-side requests by sending signed Follow activities to the public forms actor inbox route. By signing requests with their own keyId and supplying inte...

CVE-2026-103496

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

EUVD-2026-90587

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

CVE-2026-103496

In JetBrains YouTrack versions prior to 2026.2.19422 , an Insecure Direct Object Reference (iDOR) vulnerability in the inbox threads component allows an attacker to read notifications belonging to other users. The impact of this vulnerability includes unauthorized access to private notifications....

CVE-2026-103496

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

CVE-2026-75510

Novu's @novu/js In-App Inbox and @novu/react Inbox components (prior to version 3.18.0 ) are vulnerable to Stored XSS due to a lack of URL-scheme validation. An authenticated organization member or API-key holder can create a v1 in-app workflow with a call-to-action containing a javascript: redir...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

EUVD-2026-84535

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

PT-2026-96788

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 @novu/js versions prior to 3.18.0 @novu/react Inbox component versions prior to 3.18.0 Description Novu's In-App Inbox and the @novu/react Inbox component fail to validate the URL scheme of notification...