Tangled

Tangled Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail Google Workspace to deliver spoofed meeting invites that are...

islechat

isle.chat A ssh powered chat server with public and private invite-only channels Each channel has an owner who can change its banner and invite users anyone can join if its public Demo it with ssh [email protected] This project is very new right now so don't rely on it for anything critical...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2025-54320

CVE-2025-54320 Invite User Email Bombing Description The invitation API does not implement rate limiting for the target email address. This allows for an Email Bombing attack. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Na...

CVE-2023-28810

CVE-2023-28810 Exploit code for CVE-2023-28810. udp-config-changer.py Change the running configuration of a target hikvision intercom without needing any authentication. udp-password-brute.py Attempt to recover the admin password for the device via brute force guessing wordlist not supplied...

CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-65824

OpenReception's appointment booking software (prior to version 2.2.1 ) is vulnerable to a replay attack involving invite confirmation tokens. An attacker capturing a pending token can replay it to obtain a passkey-registration credential, allowing them to register their own passkey and take contr...

BIT-GHOST-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

BIT-GHOST-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

NPM: Ghost: Invite Token Disclosure in Ghost Admin API

NPM: Ghost: Invite Token Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 4.39.0, 6.64.0...

Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

GHSA-V6Q3-XQXM-6F5V Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

CVE-2026-105675

The Ghost Node.js content management system is affected by a vulnerability where staff users with permissions to view staff invites can discover secret tokens for pending invites. This flaw exists in versions 4.39.0 through 6.64.0 . An attacker could exploit this to escalate privileges by accepti...

CVE-2026-104416 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

CVE-2026-103267

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103267

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...