CVE-2025-21479-FX5P

CVE-2025-21479 · OPPO Find X5 Pro PFEM00 temporary root RAM-only temp root for OPPO Find X5 Pro PFEM00 kernel 5.10.198-android12-9, ColorOS, locked bootloader via CVE-2025-21479 Adreno KGSL → KernelSU v3.3.0 LKM late-load. 中文：READMEzh.md Chain: KGSL physical R/W → disarm OEM guard, SELinux...

ghostlock-pfem10

GhostLock — PFEM10 CVE-2026-43499 IonStack exploit for OPPO Find X5 Pro PFEM10. Kernel 5.10.236-android12-9-o, futex CMPREQUEUEPI UAF → pi-tree write primitive. Use at your own risk. Expect panics / reboots. Do not update firmware. Build ./build.sh requires Android NDK r28c Build params are fixed...

CVE-2026-116237

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116235

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116236

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugininit of the file /tmp/uploadfiles of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppdoptions leads to unrestricted upload. The attack may be launched remotel...

CVE-2026-116234

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...

CVE-2026-116233

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument renttime leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-116237

A CRLF injection vulnerability exists in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1 . This flaw allows for remote exploitation via manipulation of the affected component. While the specific part of the component is not detailed, the attack can lead to significant impact. The exploit ha...

EUVD-2026-109683

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early...

CVE-2026-116236 Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugininit of the file /tmp/uploadfiles of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppdoptions leads to unrestricted upload. The attack may be launched remotel...

EUVD-2026-109682

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugininit of the file /tmp/uploadfiles of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppdoptions leads to unrestricted upload. The attack may be launched remotel...

CVE-2026-116236

A vulnerability exists in Oray Pugongying X5 Pro 7.6.1 within the PPPoE WAN Setting Handler component. Specifically, the plugin_init function in the /tmp/upload_files file is susceptible to a flaw where manipulation of the pppd_options argument leads to unrestricted upload . This vulnerability ca...

CVE-2026-116235

A flaw in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1 allows for CRLF injection via manipulation of the Username argument. This vulnerability can be initiated remotely and has a CRITICAL base severity (CVSS 3.1 score of 9.1). While the exploit has been published and may be u...

EUVD-2026-109672

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be...

EUVD-2026-109658

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...

CVE-2026-116234

A CRLF injection vulnerability exists in the IPsec Policy Handler component of Oray Pugongying X5 Pro 7.6.1 . The vulnerability is located in an unknown function within the /etc/ipsec.conf file, where the manipulation of the secproto argument allows for remote injection. The exploit for this vuln...

CVE-2026-116234 Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...