580 matches found
OpenRelayMagic
OpenRelayMagic root@kitploit: ╔═╗┌─┐┌─┐┌┐┌╦═╗┌─┐┬ ┌─┐┬ ┬╔╦╗┌─┐┌─┐┬┌─┐ ║ ║├─┘├┤ │││╠╦╝├┤ │ ├─┤└┬┘║║║├─┤│ ┬││ ╚═╝┴ └─┘┘└┘╩╚═└─┘┴─┘┴ ┴ ┴ ╩ ╩┴ ┴└─┘┴└─┘ SMTP 서버에서 취약한 오픈 릴레이를 테스트하는 도구 기능 단일 대상/도메인 목록 확인 587 및 465 포트 구현됨 멀티스레드...
-CVE-2026-23829-CTT-Mailpit-phase-reconstruction-
SimoesCTT-mailpit-phase-reconstructor Mailpit의 SMTP 서버에 존재하는 CRLF 인젝션 — 전형적인 데이터 손상 취약점입니다. 그러나 CTT의 관점에서 이는 단순한 버그가 아닙니다. 위상 재구성phase reconstruction의 기회입니다. CVE-2026-23829 root@kitploit: CTT-Mailpit-Phase-Reconstructor CVE-2026-23829 — 새로운 물리학의 증명 --- ⚡ TL;DR 이 저장소는 CVE-2026-23829Mailpit SMTP 서버...
CVE-2024-45519
CVE-2024-45519 SMTP 취약점 악용 스크립트 개요 이 스크립트는 SMTP 서버의 취약점을 확인하고, 취약점이 발견되면 리버스 셸 연결을 설정하여 사용자 머신에 대한 접근 권한을 획득합니다. 기능 root@kitploit: 포트 확인: 대상 SMTP 포트가 열려 있는지 확인합니다. 취약점 확인: SMTP 서버의 취약점을 테스트하기 위해 페이로드를 전송합니다. 악용 및 리버스 셸: 서버가 취약한 경우 스크립트가 리버스 셸을 실행하여 원격 머신에 대한 접근 권한을 얻을 수 있게 합니다. 사용 방법 root@kitploi...
OpenSMTPD-CVE-2020-7247-
OpenSMTPD 원격 명령 실행 취약점 CVE-2020-7247 WHS 4기 박솔민 원본 링크: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md 개요 OpenSMTPD는 Unix 계열 운영체제에서 사용되는 SMTP 서버 프로그램이다. BSD, macOS, GNU/Linux 등에서 사용할 수 있으며, RFC 5321 SMTP 프로토콜을 기반으로 동작한다...
CVE-2026-75123
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
EUVD-2026-67783
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75123
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization, allowing a remote attacker...
CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-66141 vulnerabilities
Vulnerabilities for packages: exim...
GHSA-F965-GHFW-X6JX vulnerabilities
Vulnerabilities for packages: exim...
GHSA-Q496-Q274-JGH9 vulnerabilities
Vulnerabilities for packages: exim...
Vantage6: No limit on emails sent for password/MFA reset
ImpactUsers can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam...
PYSEC-2026-3399 Vantage6: No limit on emails sent for password/MFA reset
Impact Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam...
PYSEC-2026-1111 aiosmtpd STARTTLS unencrypted commands injection
Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack. References NO STARTTLS: Similar vulnerabilities discovered by previous researchers...
@3ngram/server (0.7.0), @compeso/node-red-contrib-imap-email (1.0.0) +8 more potentially affected by unknown CVE via nodemailer (9.0.0)
nodemailer NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nodemailer and may be impacted: - @3ngram/server 0.7.0 - @compeso/node-red-contrib-imap-email 1.0.0 - @hybridaione/hybridclaw =0.25.3, =2.71.0, =2.72.0 - imapflow 1.4.1 -...
BIT-DISCOURSE-2026-44784 Discourse: Non-staff group owners can see email password in plaintext through group history
Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via the group history...
CVE-2026-44784 Discourse: Non-staff group owners can see email password in plaintext through group history
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext...
