Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

islechat

isle.chat A ssh powered chat server with public and private invite-only channels Each channel has an owner who can change its banner and invite users anyone can join if its public Demo it with ssh [email protected] This project is very new right now so don't rely on it for anything critical...

Tangled

Tangled Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail Google Workspace to deliver spoofed meeting invites that are...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2025-54320

CVE-2025-54320 Invite User Email Bombing Description The invitation API does not implement rate limiting for the target email address. This allows for an Email Bombing attack. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Na...

CVE-2023-28810

CVE-2023-28810 Exploit code for CVE-2023-28810. udp-config-changer.py Change the running configuration of a target hikvision intercom without needing any authentication. udp-password-brute.py Attempt to recover the admin password for the device via brute force guessing wordlist not supplied...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

Bluewave Labs Checkmate versions up to and including 3.3.0 are affected by a privilege escalation vulnerability in the inviteController.js component. A remote authenticated administrator can exploit the role parameter at the /api/v1/invite endpoint to escalate their privileges to superadmin . The...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44846

JumpServer (open-source bastion host) has a privilege escalation flaw in apps/users/api/user.py: a user with users.invite_user permission can POST to /api/v1/users/users/invite/ with an existing member, triggering user.org_roles.set(org_roles) which overwrites that member's org roles—escalating p...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

PT-2026-76813

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py t...

CVE-2026-59717

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

EUVD-2026-54646

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...