pfsense-pppoe-secret-bang

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-pppoe-secret-bang pfsense-pppoe-secret-bang Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Username charset allows CR/LF. Password ! strip 10275 ltrims a leading ! off the password...

shiro-cve-2022-32532

Apache Shiro CVE-2022-32532 Reproduction Environment This is a minimal web application for reproducing CVE-2022-32532 Apache Shiro RegExPatternMatcher authentication bypass. Vulnerability Description CVE : CVE-2022-32532 Affected versions : Shiro 1.9.1 Cause : RegExPatternMatcher does not properl...

CVE-2022-22978-PoC

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability is related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

openSUSE 16: stgit / stgit-bash-completion / stgit-emacs / stgit-fish-completion / etc (openSUSE-SU-2026:22204-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22204-1 advisory. Changes in stgit: - Update to version 2.7.0: Allow unambiguous command shorthands, opt-in with stgit.infer-commands. Accept git approxidate...

cakephp-smtp-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-smtp-crlf Write-up: https://abraxaslabs.tech/research/cakephp-smtp-crlf cakephp-smtp-crlf Class: Mail header injection Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation GHSA-2qh5 / CVE-2026-77634...

CVE-2026-119415

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments or...

Security update for stgit (important)

openSUSE security update: security update for stgit ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22204-1 Rating: important References: bsc1262997 bsc1281742 bsc1285176 Cross-References: CVE-2026-109349 CVE-2026-109350 CVE-2026-109351 CVE-2026-919...

PT-2026-133468

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments or...

OPENSUSE-SU-2026:22204-1 Security update for stgit

This update for stgit fixes the following issues: Changes in stgit: - Update to version 2.7.0: Allow unambiguous command shorthands, opt-in with stgit.infer-commands. Accept git approxidate spellings for dates, e.g. "2 days ago" and "@"; relative dates are now anchored in the local time zone. Run...

CVE-2026-115303

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...

EUVD-2026-112675

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...

PT-2026-130670

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

EEF-CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. Th...

Twisted: HTTP Request Smuggling In Twisted.web Via A Bare CR Or LF In A Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. "twisted.web.http.HTTPChannel.headerReceived" rejects a NUL byte in a header value but not a bare CR or LF, even...

HTTP Request Smuggling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Request Smuggling via the headerReceived function in src/twisted/web/http.py, which fails to reject bare CR \r and LF \n characters in HTTP...

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

GHSA-Q7QQ-6MHP-9RC4 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

EUVD-2026-109153

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...