CVE-2019-11395

CVE-2019-11395 Overview This Proof of Concept PoC demonstrates a Buffer Overflow vulnerability in MailCarrier 2.51, allowing remote attackers to execute arbitrary code via a long string. The vulnerability can be exploited using the following processes: SMTP RCPT TO POP3 USER POP3 LIST POP3 TOP PO...

CVE-2024-21413

CVE-2024-21413 Vulnerabilidad de Ejecución Remota de Código en Microsoft Outlook https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 python3 CVE-2024-21413.py -u [email protected] -p password -d [email protected] -s mail.example.com -i -u dirección de correo del remiten...

roundcube-cve-2021-44026

Roundcube CVE-2021-44026, a SQL injection This repository contains a demo exploit for an SQL injection in Roundcube. Disclaimer : This code is intended solely for educational purposes and to assist security teams in identifying vulnerabilities in their Roundcube instances. It should only be used ...

CVE-2020-7247

CVE-2020-7247 Proof Of Concept Exploit for CVE-2020-7247 Remote Execution on OpenSMTPD 6.6.2 OpenSMTPD 6.6.2 https://www.cvedetails.com/cve/CVE-2020-7247 tested on: OpenBSD 6.6 credits to Marco Ivaldi [email protected] for payload Usage remote $ go run CVE-2020-7247.go -u 192.168.0.2 -p 25 -...

CVE-2026-73570

CVE-2026-73570 CVE-2026-73570 PoC More root@kitploit: echo 'EHLO mx-1787907797.invalid MAIL FROM: RCPT TO: QUIT\r\n' | nc 127.0.0.1 587...

CVE-2026-33234

How I Turned AutoGPT's Email Feature Into an Internal Network Scanner CVE-2026-33234 | Moderate 5.0 | GHSA-4jwj-6mg5-wrwf Author: Pavan Nallamothu I was mapping every user-controlled input that touched the network in AutoGPT Platform. The HTTP layer was locked down tight. Private IP ranges...

CVE-2026-46584

CVE-2026-46584 — Inyección de Cabeceras mail.smtp. en camel-mail Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime:...

CVE-2019-16759

vBulletin RCE 5.x Obtener Email + SMTP CVE-2019-16759 Esta herramienta extrae y vuelca Email + SMTP del servidor de base de datos USO root@kitploit: $ git clone https://github.com/mas1337/CVE-2019-16759.git && cd CVE-2019-16759 $ ./vb-email-smtp.sh list.txt Aviso legal Todo el código en este...

CVE-2024-45519

CVE-2024-45519 SMTP Vulnerability Exploit Script Overview This script checks for vulnerabilities in an SMTP server and, if found, exploits the vulnerability by establishing a reverse shell connection to your machine. Features root@kitploit: Port Checking: Verifies if the target SMTP port is open...

cve-2023-23397

CVE-2023-23397 Este script permite crear correos electrónicos de Outlook codificados en TNEF con la carga útil del exploit CVE-2023-23397 y enviarlos a través de SMTP puro, sin necesidad de objetos COM ni EWS. No pude lograr que la clase de mensaje IPM.Schedule.Meeting.Request funcionara...

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. i...

OpenSMTPD-CVE-2020-7247-

Vulnerabilidad de ejecución remota de comandos en OpenSMTPD CVE-2020-7247 WHS 4기 박솔민 Enlace original: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md Resumen OpenSMTPD es un programa servidor SMTP utilizado en sistemas operativos ti...

Zimbra Collaboration Suite 10.1.19 Command Injection

Zimbra Collaboration Suite versions 10.1.1 through 10.1.19 suffer from command injection via SMTP log poisoning. https://packetstorm.news/download/230686...

Majordomo2 - SMTP/HTTP Directory Traversal

A directory traversal vulnerability in the listfileget function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. dot dot sequences in the help command, as demonstrated using 1 a crafted email and 2 cgi-bin/mjwwwusr in the web interface. id:...

CVE-2026-73570

CVE-2026-73570 Zimbra — Collaboration Suite RCE Note: This repository contains an independent technical analysis and PoC reproduction of CVE-2026-73570. It is not the original vulnerability report. Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection CVSS 8.9, CI...

xsshunter-express

XSS Hunter Express 5분 안에 설정 완료, 유지보수 불필요 블라인드 크로스 사이트 스크립팅 취약점을 테스트하고 발견하기 위해 XSS Hunter를 설정하는 가장 빠른 방법입니다. 설정 5분 소요, 너무 대충 읽지 마세요 요구 사항 docker 및 docker-compose 설치 최소 2GB RAM을 갖춘 호스트 서버 IP에 매핑할 수 있는 호스트 이름예: host.example.com DNS 제어 권한 필요 이메일 알림용 XSS 페이로드 실행에 대한 이메일 알림을 받으려면 유효한 SMTP 자격 증명이 있는 이메일...

decode-spam-headers

decode-spam-headers.py 일상적인 관리 업무를 위해 특정 이메일이 스팸/정크함에 들어간 이유를 이해하려고 하든, 레드팀 피싱 시뮬레이션 목적으로 이해하려고 하든, 이 스크립트가 도움을 드릴 수 있습니다! 아이디어는 MS Office365 E5 환경MS Defender for Office365 탑재을 대상으로 상업용 피싱 시뮬레이션을 진행하던 중 떠올랐습니다. 짐작하시겠지만, 피싱 시뮬레이션 관점에서 보면 상당히 까다로운 보안 스택입니다. 이 모든 Office365 SMTP 헤더를 수동으로 파고들어 SCL 값을...

CVE-2026-81543 Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcapsaveconnectorsettings, wcapsendmanualemail,...

CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound...

CVE-2026-48019

Laravel (PHP web framework) prior to versions 12.60.0 and 13.10.0 is affected by a CRLF injection vulnerability in its default email validation (validateEmail() and Address.php), in combination with how Symfony Mailer and Symfony Mime handle certain character sequences. An unauthenticated attacke...