CVE-2026-116235

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116237

A CRLF injection vulnerability exists in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1 . This flaw allows for remote exploitation via manipulation of the affected component. While the specific part of the component is not detailed, the attack can lead to significant impact. The exploit ha...

CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

EUVD-2026-109683

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116235

A flaw in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1 allows for CRLF injection via manipulation of the Username argument. This vulnerability can be initiated remotely and has a CRITICAL base severity (CVSS 3.1 score of 9.1). While the exploit has been published and may be u...

EUVD-2026-109672

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116234

A CRLF injection vulnerability exists in the IPsec Policy Handler component of Oray Pugongying X5 Pro 7.6.1 . The vulnerability is located in an unknown function within the /etc/ipsec.conf file, where the manipulation of the secproto argument allows for remote injection. The exploit for this vuln...

EUVD-2026-109658

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...

CVE-2026-116233

A security vulnerability exists in Oray Pugongying X5 Pro version 7.6.1 within the Dnsmasq component. The issue is caused by the improper neutralization of CRLF sequences during the manipulation of the rent_time argument, leading to a CRLF injection vulnerability. This flaw can be exploited remot...

EUVD-2026-109657

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument renttime leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-116232

A CRLF injection vulnerability exists in the SNMP Handler component of Oray Pugongying X5 Pro 7.6.1 . The issue specifically affects the snmp_set function, where a manipulation of the info.community argument allows for remote exploitation. Public exploit code is available for this vulnerability. ...

EUVD-2026-109655

A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmpset of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to...

CVE-2026-116231

A security flaw in Oray Pugongying X5 Pro 7.6.1 allows for CRLF injection due to an unknown function within the Ser2net component. By manipulating the regmsg argument, an attacker can initiate a remote attack. While the documents indicate that an exploit has been released to the public , specific...

EUVD-2026-109654

A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to t...

CVE-2019-16278

CVE-2019-16278 - Nostromo nhttpd RCE Vulnerability Description Remote Code Execution vulnerability in Nostromo nhttpd versions 2&1 Usage python3 cve-2019-16278.py Example: python3 cve-2019-16278.py 192.168.1.100 80 "id" python3 cve-2019-16278.py 10.10.10.10 8080 "cat /etc/passwd" python3...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

CVE-2026-41940-Exploit-PoC

CVE-2026-41940 Exploit PoC – cPanel & WHM Authentication Bypass Tool by: Ishan Oshada | GitHub ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY. Unauthorized use is illegal. 📋 Table of Contents Vulnerability Overview Exploit Chain Features Installation Quick Start Usage Examples Post-Exploit Actions...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Authentication Bypass This repository contains an English, redacted write-up and a Go-based verification tool for CVE-2026-41940, a cPanel/WHM authentication bypass caused by CRLF injection in Basic Authentication handling. All live target lists, asset exports, scan...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...