nginxpwner

Nginxpwner Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities. Install: root@kitploit: cd /opt git clone https://github.com/stark0de/nginxpwner cd nginxpwner chmod +x install.sh ./install.sh Install using Docker root@kitploit: git clone...

Injectus

Injectus シンプルなPythonツール。URLリストをスキャンし、CRLFインジェクションとオープンリダイレクトのペイロードを試行します。 root@kitploit: ▪ ▐ ▄ ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ · ██ •█▌▐█ ·██▀▄.▀·▐█ ▌▪•██ █▪██▌▐█ ▀. ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄ ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█ ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀▀ BOUNTYSTRIKE usage:...

Ubiquiti UniFi OS Server < 5.1.37 Multiple Vulnerabilities

The version of Ubiquiti UniFi OS Server installed on the remote host is prior to 5.1.37. It is, therefore, affected by multiple vulnerabilities: - A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability fou...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames

A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed CRLF sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-bas...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

crlfi

徽章 许可证 MIT 安装...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update

Red Hat AMQ Broker 7.14.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames

A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed CRLF sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-bas...

PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

SummaryHTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

CVE-2026-41940-AuthBypass-Detector

Detección y Verificación de CVE-2026-41940 Resumen Esta herramienta detecta instancias de cPanel/WHM vulnerables a CVE-2026-41940 , una omisión crítica de autenticación descubierta por watchTowr Labs. La vulnerabilidad permite que un atacante no autenticado obtenga acceso root a WHM mediante una...

cPanelSniper

cPanelSniper CVE-2026-41940 — Bypass de autenticación en cPanel & WHM mediante inyección CRLF en el archivo de sesión Cadena de explotación de 4 etapas · Shell WHM interactivo · Escáner masivo · Listo para pipelines · Solo stdlib Descripción general cPanelSniper es un framework de explotación...

cPanelSniper

cPanelSniper CVE-2026-41940 — Bypass de autenticación en cPanel & WHM mediante inyección CRLF en el archivo de sesión Cadena de explotación de 4 etapas · Shell WHM interactivo · Escáner masivo · Listo para pipelines · Solo stdlib Descripción general cPanelSniper es un framework de explotación...

cPanel-CVE-2026-41940-Scanner

cPanel-CVE-2026-41940-Scanner 这款高性能安全工具旨在识别并利用 CVE-2026-41940 ，这是 cPanel & WHM 中的一个严重 CRLF 注入漏洞。它自动化了从 Shodan 发现到管理令牌创建的整个过程。 主要功能 自动化 Shodan 发现 ：基于端口、国家和特定页面范围批量获取目标。 多线程引擎 ：支持可配置线程数的高速扫描。 持久化队列系统 ：使用 SQLite 存储待处理目标，确保机器人停止时不会丢失进度。 认证绕过与令牌创建 ：自动化 4 阶段漏洞利用，泄露会话令牌并生成 WHM API 令牌。 域名提取 ：成功进入后自动从 WHM...

sorry-ransomware-analysis

Sorry 勒索软件分析（CVE-2026-41940 cPanel 攻击活动） 公开 IOC 包、YARA 规则、取证脚本及分析方法论，针对 2026 年 4 月下旬出现的 “Sorry”勒索软件 （.sorry 扩展名）家族，该家族通过 cPanel/WHM 身份验证绕过漏洞 CVE-2026-41940 传播。 ⚠️ 该勒索软件加密的文件在未获得攻击者 RSA-2048 私钥的情况下无法解密 。切勿支付赎金。请修补 cPanel、轮换所有凭据，并保留加密文件，以防日后有免费解密工具发布。 📝 完整技术文章（土耳其语）： 发布后将添加链接 本仓库内容 路径| 用途 ---|---...

CVE-2026-41940

CVE-2026-41940 ✅ Análisis del script qué hace el escáner y cómo ✅ Explicación técnica de la causa raíz el diff de CRLF/Session.pm ✅ Prevención — comandos de parcheo, lecciones de codificación segura ✅ Mitigación — reglas de firewall, configuración de WAF, endurecimiento ✅ Búsqueda de IoC —...

poc-cpanel-cve-2026-41940

POC cPanel CVE-2026-41940 一款高性能、多线程的安全审计工具，用于检测 CVE-2026-41940 ，这是 cPanel & WHM 中的一个严重身份验证绕过漏洞（于 2026 年 4 月发现）。 该工具利用 HTTP 头中的 CRLF 注入 技术，判断 cPanel 服务守护进程（cpsrvd）是否容易受到未授权 root 访问的影响。 主要特性 动态端口发现 ：若未指定端口，自动探测标准 cPanel/WHM 端口（2082、2083、2086、2087）。 智能检测 ：优先使用用户指定的端口（例如 1.2.3.4:2083），但对于裸...

CVE-2026-41940-Detection

Detección de CVE-2026-41940 Reglas de detección y esquemas de registro para la omisión de autenticación en cPanel/WHM CVE-2026-41940, por Unfold Security. Entrada de blog: Exploit de cPanel — CVE-2026-41940 Estructura root@kitploit: ├── cpanelcve202641940malget.yml Regla SIGMA — detecta la...

CVE-2026-41940

CVE-2026-41940 Exploit Automático Descripción General CVE-2026-41940 es un exploit de prueba de concepto PoC dirigido a cPanel/WHM. Este exploit demuestra una omisión de autenticación no autenticada mediante inyección CRLF para filtrar tokens de seguridad y obtener acceso de nivel root a la...