Crlf-Injection — PoC Archivehttps://poc.intelseclab.com/tags/crlf-injection/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2025-61882 (Oracle Security Alert, out-of-band, October 2025). Status: Patched (Oracle out-of-band Security Alert, October 2025). Affects: Oracle E-Business Suite — Oracle Concurrent Processing product, BI Publisher Integration component (reached via the /OA_HTML/ web tier: configurator/UiServlet and ieshostedsurvey.jsp). Tags: oracle-ebs, oracle-concurrent-processing, bi-publisher-integration, pre-auth, rce, ssrf, crlf-injection, request-smuggling, path-traversal, auth-bypass, xslt, java, cisa-kev, ransomware, cl0p, watchtowr.webCriticaloracle-ebsoracle-concurrent-processingbi-publisher-integrationpre-authrcessrfcrlf-injectionrequest-smugglingpath-traversalauth-bypassxsltjavacisa-kevransomwarecl0pwatchtowrpgAdmin 4 Restore Feature Regex-Bypass Command Injection RCE (CVE-2025-13780)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13780-pgadmin4-regex-bypass-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13780-pgadmin4-regex-bypass-rce/Critical severity (CVSS 9.1) — web · CVE-2025-13780. Status: Weaponized. Affects: pgAdmin 4. Tags: pgadmin4, postgresql, regex-bypass, command-injection, psql-meta-command, utf8-bom, crlf-injection, rce, python, cwe-77, cwe-88.webCriticalpgadmin4postgresqlregex-bypasscommand-injectionpsql-meta-commandutf8-bomcrlf-injectionrcepythoncwe-77cwe-88CRLF Email Header Injection in Plunk via Raw MIME Construction (CVE-2026-34975)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34975-plunk-crlf-email-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34975-plunk-crlf-email-injection/High severity (CVSS 8.5) — web · CVE-2026-34975. Status: PoC. Affects: Plunk (useplunk/plunk). Tags: crlf-injection, email, plunk, mime, header-injection, bcc-injection, cwe-93.webHighcrlf-injectionemailplunkmimeheader-injectionbcc-injectioncwe-93Apache APISIX forward-auth CRLF Header Injection — CVE-2026-31908https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31908-apisix-crlf-header-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31908-apisix-crlf-header-injection/Critical severity (CVSS 10) — web · CVE-2026-31908. Status: PoC. Affects: Apache APISIX. Tags: apisix, crlf-injection, header-injection, authentication-bypass, forward-auth, api-gateway, reverse-proxy.webCriticalapisixcrlf-injectionheader-injectionauthentication-bypassforward-authapi-gatewayreverse-proxycurl SMTP EXPN Recipient CRLF Command Injectionhttps://poc.intelseclab.com/pocs/network/2026-07-03_curl-smtp-expn-crlf-injection/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_curl-smtp-expn-crlf-injection/Medium severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: curl / libcurl (SMTP support). Tags: curl, smtp, crlf-injection, command-injection, expn, vrfy, protocol-injection, libcurl.networkMediumcurlsmtpcrlf-injectioncommand-injectionexpnvrfyprotocol-injectionlibcurlcPanel & WHM Authentication Bypass via Session-File CRLF Injection (CVE-2026-41940)https://poc.intelseclab.com/pocs/web/2026-05-16_cpanel-whm-auth-bypass-crlf-session-injection/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_cpanel-whm-auth-bypass-crlf-session-injection/Critical severity (CVSS 10) — web · CVE-2026-41940. Status: Weaponized. Affects: cPanel & WHM. Tags: auth-bypass, CRLF-injection, session-poisoning, cPanel, WHM, unauthenticated.webCriticalauth-bypassCRLF-injectionsession-poisoningcPanelWHMunauthenticated