cakephp-smtp-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-smtp-crlf cakephp-smtp-crlf Class: Mail header injection Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation GHSA-2qh5 / CVE-2026-77634 added strreplace"\r\n", '', $val on SmtpTransport and...

CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover

🎯 CTT-Mailpit-Exploit: Perfect 11/10 Score Zero-Click Worm Transform a basic SMTP header injection CVE-2026-23829 into a perfect-scoring, self-propagating RCE worm using Convergent Time Theory. 📊 Score Transformation: 6.1 → 11.0/10 ⭐ Metric Original CVE-2026-23829 CTT-Enhanced Improvement CVSS...

crlf-powered-desync-scanner

CRLF-Powered Desync Scanner This is the Burp Extension we used to detect all cases from our research CRLF-Powered Desync Attacks: Beheading HTTP Streams. It's a research-first scanner built using BulkScan similar to HTTP Request Smuggler and others. Implementation Request Header Injection probe...

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical- Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in has an easily exploitable, unauthenticated, network-reachable flaw allowing compromise over HTTP. Affected supported versions include 12.2.1.4.0,...

log4jcheck

Northwave Log4j CVE-2021-44228 checker Friday 10 December 2021 a new Proof-of-Concept 1 addressing a Remote code Execution RCE vulnerability in the Java library 'log4j' 2 was published. This vulnerability has not been disclosed to the developers of the software upfront. The vulnerability is being...

CVE-2022-24181

CVE-2022-24181 and CVE-2022-26616. both are probably same Open-journal-system-Vulnerability XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce: 1. Go to this site: https://who's-using-ojs-software.com 2. And capture this request in burp , and send to...

CVE-2026-31908

CVE-2026-31908 - Apache APISIX Header Injection Exploit 📋 Overview This is a Proof of Concept PoC exploit for CVE-2026-31908 , a critical header injection vulnerability discovered in Apache APISIX versions 2.12.0 through 3.15.0. The vulnerability exists in the forward-auth plugin, where improper...

CPanel-Audit-Remediation-Tool

🛡️ Oscar Constanzo Audit & Patch Tool CVE-2026-41940 Professional Security Auditing & Incident Response Suite for cPanel Infrastructure. 📖 Description This tool was developed by Oscar Constanzo Quezada, AKA Underhost to identify and remediate the CVE-2026-41940 vulnerability in cPanel servers. The...

CVE-2026-63621

CVE-2026-63621 — camel-knative structured CloudEvent header injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Style ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-knative 4.18.2|...

CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket producer selects its WebSocket recipients from websocket. Exchange headers whose names fall outside the Camel namespac...

CVE-2026-78329

CVE-2026-78329 — camel-undertow header filter strategy not applied websocket. injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where UndertowEndpoint defaulted its headerFilterStrategy to the base HttpHeaderFilterStrategy and pushed that instance into the...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: HTTP Response Header Injection CRLF in Mastodon Streaming Server Vulnerability Overview Item| Details ---|--- CVE ID| CVE-2026-XXXXX Affected Product| Mastodon Streaming Server Affected Version| $key: $headerskey.join' ' ; Impact HTTP Header Injection: Inject ar...

CVE-2026-59230

CVE-2026-59230 — camel-mail MimeMultipart header injection headersInline Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-spring-boot 4.18.2 Camel...

CVE-2026-94380 Host Header Injection in HAVELSAN's Liman MYS

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131...

CVE-2026-94380

The HAVELSAN Inc. Liman MYS software (versions 2.3.4-1124 through 2.3.5-1131 ) is vulnerable to a Weak Password Recovery Mechanism for forgotten passwords (CWE-640 ). This flaw allows for Password Recovery Exploitation , potentially leading to high impacts on confidentiality and integrity as refl...

XSSTracer

XSSTracer v1.3 by 1N3 @CrowdShield https://crowdshield.com XSSTracer is a small python script that checks remote web servers for Clickjacking, Cross-Frame Scripting, Cross-Site Tracing and Host Header Injection. Usage: ./xsstracer...

CVE-2026-3854

CVE-2026-3854: RCE on GitHub via X-Stat header injection Practical summary of how the vulnerability discovered by Wiz Research in GitHub.com and GitHub Enterprise Server's internal git push pipeline works. Disclaimer This material is for educational purposes and offensive security research. The...

CVE-2021-27404

Authenticated Host Header Injection - Askey Internet Fiber Modem Vendor: Askey Software Version: BRSVg11.11RTFTEF001V6.54V014 Model: RTF8115VW Vulnerable Header: Host Not tested in other model/version. Impact: An attacker could take advantege on that vulnerability to redirect user to a fake Login...

403Kangaroo

403Kangaroo !! This tool is still under development if you have any issues please don't hesitate to contact me via linkedin or smth 403/401 bypass tool via certain headers and values headers.txt,values.txt. When you load the extension for the first time it will open a headers.txt file and write t...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem Overview An improper authorization and header-spoofing vulnerability was reported regarding Knowns' reverse proxy for an embedded OpenCode AI agent daemon...