tag
Crlf-Injection
Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)
CVE-2025-61882 is an unauthenticated remote code execution chain in Oracle E-Business Suite 12.2.3 through 12.2.14. An attacker POSTs an XML document to the unauthenticated /OAHTML/configurator/UiServlet endpoint; the servlet extracts a returnurl element from…
pgAdmin 4 Restore Feature Regex-Bypass Command Injection RCE (CVE-2025-13780)
pgAdmin 4's database Restore feature attempts to block dangerous psql meta-commands — which begin with a backslash (\) and can execute arbitrary shell commands via \! — using the regular expression (^|\n)[ \t]\\. This regex only matches a backslash that…
CRLF Email Header Injection in Plunk via Raw MIME Construction (CVE-2026-34975)
Plunk's POST /v1/send endpoint builds a raw MIME email message by interpolating user-supplied fields (from.name, subject, custom headers, attachment filenames) directly into a template string without sanitizing CRLF (\r\n) sequences. An authenticated API user…
Apache APISIX forward-auth CRLF Header Injection — CVE-2026-31908
Apache APISIX's forward-auth plugin fails to sanitize CRLF (\r\n) sequences in inbound request headers before forwarding an authentication check upstream. By injecting CRLF sequences into headers such as Authorization, X-Forwarded-For, or Host, an…
curl SMTP EXPN Recipient CRLF Command Injection
Stock curl does not reject CR/LF sequences in the recipient operand used with SMTP EXPN/VRFY custom requests (CURLOPTMAILRCPT), allowing an attacker who controls that operand to inject arbitrary additional SMTP protocol lines into the same authenticated…
cPanel & WHM Authentication Bypass via Session-File CRLF Injection (CVE-2026-41940)
CVE-2026-41940 is a critical unauthenticated authentication bypass in cPanel & WHM. The vulnerable session handling flow writes attacker-controlled Authorization: Basic data to the session file before sanitization, allowing CRLF injection of trusted session…