CVE-2019-16759

vBulletin RCE 5.x Get Email + SMTP CVE-2019-16759 This tools will extracts and dumps Email + SMTP from database server USAGE $ git clone https://github.com/mas1337/CVE-2019-16759.git && cd CVE-2019-16759 $ ./vb-email-smtp.sh list.txt Disclaimer All code on this repository is for educational...

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

GHSA-XGJR-7J9Q-2H4R listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

WordPress Redux Framework authorization issue vulnerability

WordPress Redux Framework versions 4.5.15 and earlier contain an authorization issue vulnerability. This vulnerability arises because the plugin fails to properly verify whether a user is authorized to perform certain actions. As a result, authenticated attackers with subscriber-level or higher...

EUVD-2026-112691

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-115299

The Contact Form by Supsystic WordPress plugin, in versions prior to 1.11.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The issue arises because the plugin fails to verify a CSRF nonce when saving mail settings. A remote attacker can exploit this by tricking a logged-in administr...

PT-2026-130690

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-91153: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-100701

A flaw was found in nodemailer. In multi-tenant environments, a remote attacker can exploit a cache confusion vulnerability by priming the shared Domain Name System DNS cache with a custom Transport Layer Security TLS server name. Because cached entries overwrite subsequent connection...

CVE-2026-100701 Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports secure: true resolve the same non-IP host with different tls.servername values, t...

CVE-2026-100701 Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports secure: true resolve the same non-IP host with different tls.servername values, t...

PT-2026-95104

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...

CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability in the Settings resource. The read policy uses an always-allow authorization check that bypasses all identity verification, allowing unauthenticated attackers to send a GET request to the settings API endpoint with a valid reco...

EUVD-2026-64068

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-61842

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet'config' to return the raw configuration object and permits jsonencode, printr, yamlencode, and string filters to serialize that object without passing through...

SonarQube - Authentication Bypass Detection

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. !/usr/bin/env python3 -- coding: utf-8 -- """SonarQube 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...