SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. id: CVE-2017-18518 info: name: SMTP by BestWebSoft 1.1.0 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. impact: |...

SMTP WP Plugin Directory Listing

The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. id: CVE-2020-35234 info: name: SMTP WP Plugin Directory Listing author: PR3R00T severity: high description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and i...

SonarQube - Authentication Bypass

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. id: CVE-2020-27986 info: name: SonarQube - Authentication Bypass author: pikpikcu severity: high description: | SonarQube 8.4.2.36762 allows remote attackers to...

Post SMTP <= 3.6.0 - Email Log Disclosure

Post SMTP WordPress plugin = 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication. id: CVE-2025-11833 info: name: Post SMTP = 3.6.0 -...

D-Link Central WifiManager - Server-Side Request Forgery

D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

CVE-2024-21413

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC 🚀 Usage Ensure you have appropriate permissions and authorization from the target system owner before using this script. Prerequisites Python 3.x impacket-smbserver Usage Example root@kitploit: sudo python3 CVE-2024-21413....

CVE-2026-73570

CVE-2026-73570 PoC - SMTP Command Injection Tester A custom, low-level Python proof-of-concept PoC script for testing SMTP command injection vulnerabilities CVE-2026-73570. This tool sends a malformed RCPT TO address containing shell-style command substitution e.g., $command to determine if the...

-CVE-2026-23829-CTT-Mailpit-phase-reconstruction-

SimoesCTT-mailpit-phase-reconstructor It's a CRLF injection in Mailpit's SMTP server — a classic data corruption vulnerability. But under CTT, it's not just a bug. It's a phase reconstruction opportunity. CVE-2026-23829 root@kitploit: CTT-Mailpit-Phase-Reconstructor CVE-2026-23829 — Proof of Nove...

CVE-2023-51764

CVE-2023-51764 CVE-2023-51764 poc Link: https://github.com/duy-31/CVE-2023-51764 1. Add SMTP authentication 2. The script has only been tested on Kali 3. Please do not use the script for illegal purposes...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

CVE-2023-7028-Docker

CVE-2023-7028 with Docker 🎯 Want to practice with the new gitlab CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2023-7028-Docker.git. 3. Go to the project : cd CVE-2023-7028-Dock...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

WifiPassword-Stealer

WifiPassword-Stealer Get All Registered Wifi Passwords from Target Computer. INSTALLATION if you are using a python file root@kitploit: pip install smtplib pip install subprocess pip install glob USAGE •Create an account on "https://mailtrap.io/" using a temp mail. •Set your own SMTP USERNAME and...

CVE-2019-11395

CVE-2019-11395 Exploit 🛡️ About CVE-2019-11395 🕵️ The CVE-2019-11395 vulnerability describes a buffer overflow vulnerability in the MailCarrier 2.51 email application, allowing remote code execution. The vulnerability occurs in SMTP RCPT TO, POP3 USER, POP3 LIST, POP3 TOP, or POP3 RETR processes...

CVE-2026-92598

Nodemailer before 9.1.0 (a widely used Node.js mail library) fails to apply UTS-46 normalization when encoding international domain names. This causes the library's internal domain resolver to compute a different Punycode A-label than standards-compliant parsers. An attacker can craft recipient a...

Network-Analysis-Tools

Pcap Capture File Analysis Toolv.1 root@kitploit: !CONTACT! | Email: [email protected] | | Github: github/azizaltuntas | | Twitter: @esccopyright | Features root@kitploit: 1-Top 10 Visited Sites 2-Emails 3-All Request Urls 4-User-Agents List 5-String Grep Mode 6-Connection details 7-Ports Us...

CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover

🎯 CTT-Mailpit-Exploit: Perfect 11/10 Score Zero-Click Worm Transform a basic SMTP header injection CVE-2026-23829 into a perfect-scoring, self-propagating RCE worm using Convergent Time Theory. 📊 Score Transformation: 6.1 → 11.0/10 ⭐ Metric Original CVE-2026-23829 CTT-Enhanced Improvement CVSS...

CVE-2023-51764

PoC for CVE-2023-51764 SMTP SMUGGLING Postfix CVE-2023-5176525.py Description This script allows sending messages using port 25 of the mail server. Usage Before running, modify the variables: smtpserver - address of the mail server fromaddress - sender of the first email toaddress - recipient of...