CVE-2026-41940

CVE-2026-41940 — cPanel/WHM Auth Bypass Author: Dr.Anach | Contact: @dranach | License: MIT Overview CRLF injection in cpsrvd Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected. Attack Chain | Step| Request ---|---|--- 1| Mint session| GET...

gitlab-ssrf

GitLab SSRF This repository is a reproduction of CVE-2018-19571, and how when combined with a CRLF injection exploit, can lead to remote code execution RCE. CVE Details CVE-2018-19571 GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable...

CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880

The benoitc hackney library (versions 2.0.0 before 4.9.0) is vulnerable to an HTTP Request Splitting vulnerability (CWE-113) in the hackney_http_connect module. The root cause is the lack of control-byte validation on the binary returned by the proxy_auth_fun callback. When a proxy returns a 407 ...

EUVD-2026-109833

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

003Recon

📌 Description This repository contains some of my scripts that i created to automate some recon processes. It performs the following things; 1. Get subdomains of a domain 2. Filter out only online domains 3. Scan the domains for CRLF 4. Check for a CORS misconfigurations 5. Test for open redirect...

CVE-2026-116237

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116235

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116233

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument renttime leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-116234

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...

CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116237

A CRLF injection vulnerability exists in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1 . This flaw allows for remote exploitation via manipulation of the affected component. While the specific part of the component is not detailed, the attack can lead to significant impact. The exploit ha...

EUVD-2026-109683

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

EUVD-2026-109672

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116235

A flaw in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1 allows for CRLF injection via manipulation of the Username argument. This vulnerability can be initiated remotely and has a CRITICAL base severity (CVSS 3.1 score of 9.1). While the exploit has been published and may be u...

CVE-2026-116234

A CRLF injection vulnerability exists in the IPsec Policy Handler component of Oray Pugongying X5 Pro 7.6.1 . The vulnerability is located in an unknown function within the /etc/ipsec.conf file, where the manipulation of the secproto argument allows for remote injection. The exploit for this vuln...

EUVD-2026-109658

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...

CVE-2026-116232

A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmpset of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to...