161 matches found
CVE-2020-7247-POC
Foreword Key facts about the exploit Installing the vulnerable server Configuration Environment disclaimers Exploit Manual Exploitation Scripted Exploitation Foreword This repository should serve as a base to set up and exploit CVE-2020-7247 in a controlled and private environment. All of the...
sendmail-clamav-exploit-CVE-2007-4560
Sendmail + ClamAV-Milter Exploit CVE-2007-4560 Python RCE exploit for Sendmail with ClamAV-Milter After successful exploitation: nc 1001 bash -i Tested On Sendmail 8.13.4/8.13.4/Debian-3sarge3 ClamAV-Milter 0.91.2 References Original exploit: https://www.exploit-...
CVE-2026-73570
CVE-2026-73570 CVE-2026-73570 PoC More echo 'EHLO mx-1787907797.invalid MAIL FROM: RCPT TO: QUIT\r\n' | nc 127.0.0.1 587...
CVE-2026-73570
CVE-2026-73570 PoC - SMTP Command Injection Tester A custom, low-level Python proof-of-concept PoC script for testing SMTP command injection vulnerabilities CVE-2026-73570. This tool sends a malformed RCPT TO address containing shell-style command substitution e.g., $command to determine if the...
Nodemailer: RFC 5322 Comment Inside An Angle-bracket Address Is Never Stripped
Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment " ... " handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5...
GHSA-G73G-HQQH-JR95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...
Astra Linux – Vulnerability in exim4
Exim 4 before 4.94.2 has an improper restriction on write operations within the bounds of a memory buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands...
CVE-2026-110870
The Nodemailer library (versions 3.0.0 to before 10.0.13 ) is vulnerable to an improper input validation flaw in its address parser. The vulnerability stems from a failure to strip RFC 5322 comments found inside angle-bracket addresses. An attacker can provide a recipient containing a display nam...
SUSE CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
DEBIAN-CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
UBUNTU-CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
EUVD-2026-76774
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, enabling ESMTP parameter injection into MAIL FROM and RCPT TO envelope commands. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters such as AUTH , NOTIFY , or ORC...
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
PT-2026-90555
Name of the Vulnerable Software and Affected Versions aiosmtplib versions prior to 5.1.3 Description The software fails to properly validate email addresses provided by callers, which enables ESMTP parameter injection into the MAIL FROM and RCPT TO command lines. By crafting malicious addresses...
CVE-2026-90467: Improper Neutralization of Argument Delimiters in a Command
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-73570
CVE-2026-73570 PoC - Probador de Inyección de Comandos SMTP Un script personalizado de prueba de concepto PoC en Python de bajo nivel para probar vulnerabilidades de inyección de comandos SMTP CVE-2026-73570. Esta herramienta envía una dirección RCPT TO malformada que contiene sustitución de...