CVE-2018-8718

漏洞标题 : Jenkins mailer 插件 CSRF 漏洞 - 发送 CSRF 邮件 日期 : 2018/06/05 利用作者 : Yeom Geun Cheol 厂商主页 : https://jenkins.io/ 软件链接 : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi 版本 : 版本低于 1.20 1.1 1.20 测试环境 : Linux , Windows CVE : CVE–2018-8718 CVE-2018-8718 的 PoC + 工具...

fake-mailer

Fake Mailer + 免责声明： Fake Mailer 是一个用于从不同邮箱匿名发送邮件的工具。此过程可能需要5分钟。本工具仅用于教育目的！我不对任何滥用此工具的行为负责！ 安装： apt update apt install git python2 -y git clone https://github.com/htr-tech/fake-mailer cd fake-mailer 运行：python2 mailer.py 或者使用单行命令： root@kitploit: apt update && apt install git python2 -y && git clone...

CVE-2026-33715

CVE-2026-33715 — Unauthenticated SSRF + Open Email Relay in Chamilo LMS via install.ajax.php Severity : High CVSS 7.2 CWE : CWE-918 SSRF + CWE-306 Missing Authentication Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-mxc9-9335-45mc NVD :...

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. i...

CVE-2026-48019

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound...

CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound...

CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound...

CVE-2026-48019

Laravel (PHP web framework) prior to versions 12.60.0 and 13.10.0 is affected by a CRLF injection vulnerability in its default email validation (validateEmail() and Address.php), in combination with how Symfony Mailer and Symfony Mime handle certain character sequences. An unauthenticated attacke...

DRUPAL-CONTRIB-2026-128

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can...

EulerOS Virtualization 2.13.0 : sudo (EulerOS-SA-2026-3241)

According to the versions of the sudo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the...

CVE-2026-70927

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow...

EUVD-2026-61878

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow...

EUVD-2026-61874

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow...

PT-2026-77918

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description An issue exists in the Workflow Notification Mailer component of the Oracle Workflow product. An unauthenticated attacker with network access via HTTP can...

PT-2026-77922

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-77917

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows an unauthenticated attacker with network access via SMTP to compromise the system. Successful...

EulerOS 2.0 SP11 : sudo (EulerOS-SA-2026-3105)

According to the versions of the sudo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not...

EulerOS 2.0 SP13 : sudo (EulerOS-SA-2026-3052)

According to the versions of the sudo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not...

EulerOS 2.0 SP13 : sudo (EulerOS-SA-2026-3002)

According to the versions of the sudo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not...

CVE-2026-15951

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...