Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | FROM HEADER INJECTION TO FULL RCE DOMINANCE The Original Flaw (CVE-2026-23829) · CVSS: 6.1/10 (Medium) - Header injection via regex bypass · Impact: Email spoofing, limited header manipulation · Reality: Boring, basic, barely worth weaponizing CTT Enhancement Revelation | https://github.com/SimoesCTT/CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover | POC Details |
| 2 | It's a CRLF injection in Mailpit's SMTP server — a classic data corruption vulnerability. But under CTT, it's not just a bug. It's a phase reconstruction opportunity. | https://github.com/SimoesCTT/-CVE-2026-23829-CTT-Mailpit-phase-reconstruction- | POC Details |
| 3 | Mailpit < 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23829.yaml | POC Details |
| 4 | Mailpit < 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses | https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-23829.yaml | POC Details |
No public POC found.
Login to generate AI POCNo comments yet