The vulnerability of the software platform based on Git for collaborative code development in GitLab Enterprise Edition (EE) arises from the lack of measures taken to protect the structure of web pages. This allows attackers to add email addresses to target accounts.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to remotely add email addresses to target...

CVE-2026-35542

A flaw was found in Roundcube Webmail. A remote attacker could bypass the remote image blocking feature by sending a specially crafted email containing a malicious background attribute within a BODY element. This vulnerability may lead to unauthorized information disclosure or an access-control...

CVE-2026-1670 Honeywell CCTV Products Missing Authentication for Critical Function

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address...

The vulnerability of the Bitrix24 business management service lies in the lack of measures taken to protect the website structure, allowing attackers to control the content of email messages.

The vulnerability of the Bitrix24 business management service is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to control the content of email messages remotely...

EUVD-2006-7093

Malware in sbrugna...

EUVD-2009-1586

Malware in sbrugna...

EUVD-2024-2498

Malicious code in bioql PyPI...

The vulnerability of the Blitz Identity Provider software, related to deficiencies in the authentication process, allows a perpetrator to change the email address of a user’s account.

The vulnerability of the Blitz Identity Provider software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to change the email address of a user’s account remotely...

CVE-2024-45231: Observable Discrepancy

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome only...

SUSE CVE-2017-12375

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail...

CVE-2017-1214: Exposure of Sensitive Information to an Unauthorized Actor

IBM iNotes 8.5 and 9.0 could allow a remote attacker to send a malformed email to a victim, that when opened could cause an information disclosure. IBM X-Force ID: 123854...

CVE-2016-4841: Improper Input Validation

Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers...

Wix Remote Email PoC 0day

Wix send remote email affects all pages created with wix.com, possible social engineering attack. Usage Info usage: exploit.py -h -u URL -t EMAILTO -f EMAILFROM -s SUBJECT -i SITEID -m MESSAGE This is private exploit. You can buy it at https://0day.today...

PT-2012-6038

Name of the Vulnerable Software and Affected Versions Email Field module versions 6.x-1.x before 6.x-1.3 for Drupal Description The issue allows remote attackers to email the stored address via unspecified vectors when the field contact field formatter is set to the full or teaser display mode an...

CVE-2012-5588: Undefined Security Weakness

The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors...

CVE-2009-1589: Undefined Security Weakness

Unspecified vulnerability in CGI RESCUE MiniBBS22 before 1.01 allows remote attackers to send email to arbitrary recipients via unknown vectors...

Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit

Exploit for multiple platform in category remote exploits ============================================================= Dovecot IMAP 1.0.10 1.1rc3 Exploit Here's an exploit for the recent TAB vulnerability in Dovecot. It's nothing special since in the wild there are few to none targets because of...

DeluxeBB <= 1.09 Remote Admin Email Change Exploit

Exploit for unknown platform in category web applications ================================================== DeluxeBB unbufferedquery"UPDATE ".$prefix."users SET email='$xemail', msn='$xmsn', icq='$xicq', ... WHERE username='$membercookie'"; So, editing cookie "membercookie" you can change remote...

CVE-2007-2372

CVE-2007-2372 affects phpMyNewsletter 0.8 beta5 and earlier. The admin/send_mod.php path prints a Location header but does not exit when administrative credentials are missing, enabling remote attackers to craft an e-mail via a POST containing subject, message, format, and list_id, then send the ...

CVE-2006-4344: Undefined Security Weakness

CRLF injection vulnerability in CGI-Rescue Mail F/W System formd before 8.3 allows remote attackers to spoof e-mails and inject e-mail headers via unspecified vectors in 1 mail.cgi and 2 query.cgi...