Tools

networksecure/cve-2020-14064

Proof-of-concept exploit for CVE-2020-14064, an incorrect access control vulnerability in Icewarp Email Server 12.3.0.1, enabling unauthorized access.

randomrobbiebf/cve-2021-24959

WP Email Users <= 1.7.6 - SQL Injection

nxploited/cve-2025-4796

Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover

thewoodenbench/cve-2025-66956

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute…

tghook/cve-2024-4295-poc

CVE-2024-4295 Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash

dillonkirsch/cve-2021-41074

Proof-of-concept CSRF exploit targeting Qloapps HotelCommerce 1.5.1 that allows unauthorized admin email changes via crafted HTML documents.

jerrylewis9/cve-2019-20361-exploit

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in…

rasyidfox/cve-2019-18818

Exploit for CVE-2019-18818 allowing password reset of admin accounts via email. Useful for penetration testing and vulnerability verification of…

googlei1996/cve-2023-7028

Proof-of-concept exploit for CVE-2023-7028, a GitLab account takeover vulnerability via email confirmation bypass, demonstrating the attack with…

cve-2024/cve-2024-4295-poc

Proof-of-concept exploit for CVE-2024-4295, an unauthenticated SQL injection in Email Subscribers by Icegram Express <= 5.7.20 via the hash parameter.

geraldoalcantara/cve-2023-49546

Customer Support System 1.0 - SQL Injection Vulnerability in the "email" Parameter During "save_staff" Operation

paragbagul111/cve-2024-25412

A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected…

allevon412/cve-2024-54951

I contacted the monica development team via email on 11/20/2024. I also contacted them via LinkedIn, and other platforms in the weeks that followed.…

e1tex/cve-2023-48104

Proof-of-concept exploit demonstrating HTML injection in SOGo Web Client before 5.9.1, enabling phishing attacks via malicious forms in email bodies.

shimon03/cve-2023-7028-account-take-over-gitlab

Proof-of-concept exploit for CVE-2023-7028, automating GitLab account takeover via password reset email manipulation. Includes temp-mail integration…

buraksevben/cve-2024-24139

Proof-of-concept exploit demonstrating SQL injection in a login system with email verification, targeting CVE-2024-24139 for security testing and…

hf3cyber/cms-made-simple-2.2.9-unauthenticated-sql-injection-exploit-cve-2019-9053-

Time-based blind SQL injection exploit for CMS Made Simple <= 2.2.9 (CVE-2019-9053) that extracts username, email, password hash, and salt, with…

nxploited/cve-2024-0235-poc

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing…