PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-24031 PoC: Dovecot SQL authentication bypass and user enumeration

github.com | tool | CVE-2026-24031 | #public-poc | #authentication-bypass | #sql-injection | #pre-auth | #email-security | #authentication | #dovecot | #user-enumeration | #cve | #poc | #cve-2026-24031 | #mail-server
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Python PoC for CVE-2026-24031, a Dovecot SQL passdb injection allowing authentication bypass and user enumeration when auth_username_chars is emptied; validated on Dovecot 2.4.0 with PostgreSQL.

Why it matters

The public PoC demonstrates that the vulnerable configuration can turn a mail authentication query into unauthenticated remote account takeover and user enumeration. Restore a safe auth_username_chars value and upgrade to Dovecot 2.4.3 or OX Dovecot Pro 3.1.4 or later.
CVE
CVE-2026-24031
Vendor
Open-Xchange
Product
Dovecot
Affected versions
Dovecot >= 2.4.0, < 2.4.3; OX Dovecot Pro >= 3.1.0, < 3.1.4; requires SQL passdb and empty auth_username_chars
CVSS
7.7
Published
Collected

Related coverage

tool · github.com
CVE-2026-55040 PoC: Microsoft SharePoint JWT authentication bypass
The public PoC can generate a forged authentication token for a specified account, substantially lowering the barrier to validation and reproduction. Apply Microsoft security updates immediately and test only in isolated, authorized environments.
Critical · vulnerability · github.com
Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject
This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
Critical · vulnerability · github.com
CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation
This is a public pre-auth remote-code-execution PoC, and although offsets are hardcoded for a specific build, it materially lowers the exploitation barrier. NetScaler administrators should upgrade affected builds per the Citrix bulletin and restrict exposed Gateway/AAA surfaces; use the PoC only in explicitly authorized isolated environments.
vulnerability · netspi.com
PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619
# PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 October 21, 2026 ### Team NetSPI The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and...
High · vulnerability · pwn.ai
XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)
WordPress powers a large share of internet-facing sites. The pre-auth login-screen XSS can execute JavaScript in the site origin after victim interaction and, under the documented conditions, be chained into impact on administrator sessions and the server. Upgrade to WordPress 7.0.3 or the corresponding patched maintenance branch, then review login activity, administrator sessions, and unexpected plugins or file changes. The current CVE record assigns CVSS 4.0 8.9 (High) and requires active user interaction; no active-exploitation signal is currently recorded.
blog · blog.viettelcybersecurity.com
A Saga of Code Executions on Zimbra
Research into Zimbra Collaboration Suite finds at least one potential remote code execution vulnerability across all Zimbra versions, notable for a product with little security history since 2013.
Back