Common Weakness Enumeration
CWE-93
AllowedImproper Neutralization of CRLF Sequences ('CRLF Injection')
Abstraction: Base · Status: Draft
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
486 vulnerabilities reference this CWE, most recent first.
CVE-2026-119560 (GCVE-0-2026-119560)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
Summary
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/opnsense-ntp-gp… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:08.046274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:16.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:08.977Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49"
},
{
"name": "GitHub Security Advisory (GHSA-fq94-cxvc-9r7w)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields"
}
],
"title": "OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119560",
"datePublished": "2026-10-30T11:31:08.977Z",
"dateReserved": "2026-10-30T10:53:29.701Z",
"dateUpdated": "2026-10-30T15:54:16.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119424 (GCVE-0-2026-119424)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
Summary
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Severity
6.8 (Medium)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/9f1eac0f9… | patch |
| https://github.com/opnsense/core/commit/3bbd714b4… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-wlan-w… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:54.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/9f1eac0f9bdf705766ab61f9d62b9d55757fd0da"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/3bbd714b4c4b60f164e2e908501f208d3eadf645"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml#L185"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/etc/inc/interfaces.inc#L1901"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-wlan-wpa-line"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-before-26.7.8-wireless-wpa-configuration-line-injection-via-identity"
}
],
"title": "OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119424",
"datePublished": "2026-10-30T11:30:54.395Z",
"dateReserved": "2026-10-30T02:41:13.590Z",
"dateUpdated": "2026-10-30T11:30:54.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119417 (GCVE-0-2026-119417)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
Summary
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/cakephp/commit/2b9326c… | patch |
| https://github.com/cakephp/cakephp/commit/7735874… | patch |
| https://github.com/cakephp/cakephp/commit/3b99731… | patch |
| https://github.com/cakephp/cakephp/commit/e5936b2… | patch |
| https://github.com/cakephp/cakephp/pull/19695 | patchissue-tracking |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://github.com/cakephp/cakephp/security/advis… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/cakephp-smtp-crlf | third-party-advisory |
| https://github.com/cakephp/cakephp | product |
| https://www.vulncheck.com/advisories/cakephp-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cakephp | cakephp |
Affected:
4.5.12 , ≤ 4.5.12
(semver)
Affected: 4.6.5 , ≤ 4.6.5 (semver) Affected: 5.1.8 , ≤ 5.1.10 (semver) Affected: 5.2.14 , ≤ 5.2.15 (semver) Affected: 5.3.7 , ≤ 5.3.7 (semver) Affected: 5.4.0 , ≤ 5.4.3 (semver) cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* |
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:55.429443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:41.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cakephp/cakephp",
"product": "cakephp",
"repo": "https://github.com/cakephp/cakephp",
"vendor": "cakephp",
"versions": [
{
"lessThanOrEqual": "4.5.12",
"status": "affected",
"version": "4.5.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.6.5",
"status": "affected",
"version": "4.6.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.10",
"status": "affected",
"version": "5.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.15",
"status": "affected",
"version": "5.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.3.7",
"status": "affected",
"version": "5.3.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.3",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.5.12",
"versionStartIncluding": "4.5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.6.5",
"versionStartIncluding": "4.6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.1.10",
"versionStartIncluding": "5.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.2.15",
"versionStartIncluding": "5.2.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.3.7",
"versionStartIncluding": "5.3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4.3",
"versionStartIncluding": "5.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mark Story"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:49.444Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/cakephp/cakephp/pull/19695"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57"
},
{
"name": "GitHub Security Advisory (GHSA-2qh5-382h-3jpc)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/cakephp-smtp-crlf"
},
{
"tags": [
"product"
],
"url": "https://github.com/cakephp/cakephp"
},
{
"name": "VulnCheck Advisory: CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport"
}
],
"title": "CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119417",
"datePublished": "2026-10-30T11:30:49.444Z",
"dateReserved": "2026-10-30T02:41:11.166Z",
"dateUpdated": "2026-10-30T15:55:41.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119415 (GCVE-0-2026-119415)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type
Summary
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
Severity
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/cakephp/commit/2e54c22… | patch |
| https://github.com/cakephp/cakephp/commit/27263ae… | patch |
| https://github.com/cakephp/cakephp/commit/c9a9114… | patch |
| https://github.com/cakephp/cakephp/commit/d66e016… | patch |
| https://github.com/cakephp/cakephp/pull/19715 | patchissue-tracking |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://abraxaslabs.tech/research/cakephp-attachm… | third-party-advisory |
| https://github.com/cakephp/cakephp | product |
| https://www.vulncheck.com/advisories/cakephp-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cakephp/cakephp",
"product": "cakephp",
"repo": "https://github.com/cakephp/cakephp",
"vendor": "cakephp",
"versions": [
{
"lessThanOrEqual": "5.4.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mark Story"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:48.078Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/2e54c227eaa4c0e0d5edd74931710fd4f8bc38b5"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/27263ae750a3cd8464a5db076f48a731c8283df2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/c9a91149f04e2aee7faa30ed57d40f5b91d3f79e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/d66e016d2fd9667dd605b56e25fbb3df5365406a"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/cakephp/cakephp/pull/19715"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Client/FormDataPart.php#L200"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Message.php#L1181"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/cakephp-attachment-crlf"
},
{
"tags": [
"product"
],
"url": "https://github.com/cakephp/cakephp"
},
{
"name": "VulnCheck Advisory: CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cakephp-through-5.4.3-mime-header-injection-via-formdatapart-content-type"
}
],
"title": "CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119415",
"datePublished": "2026-10-30T11:30:48.078Z",
"dateReserved": "2026-10-30T02:41:10.464Z",
"dateUpdated": "2026-10-30T11:30:48.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118372 (GCVE-0-2026-118372)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 16:11
VLAI
EPSS
VEX
Title
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
Summary
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 14:35 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openbsd/src/commit/6efdc4cce3f… | patch |
| https://github.com/openbsd/src/commit/3adb7688a5b… | patch |
| https://github.com/openbsd/src/blob/17a8e44328ee2… | technical-description |
| https://github.com/openbsd/src/blob/17a8e44328ee2… | technical-description |
| https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libr… | release-notes |
| https://github.com/libressl/portable | product |
| https://www.vulncheck.com/advisories/libressl-ocs… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T14:35:30.401668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:11:41.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libressl/portable",
"product": "LibreSSL",
"repo": "https://github.com/libressl/portable",
"vendor": "OpenBSD",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Kenjiro Nakayama"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate\u0027s AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:20.849Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23d"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L344"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/ocspcheck.c#L154"
},
{
"name": "LibreSSL 4.4.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt"
},
{
"tags": [
"product"
],
"url": "https://github.com/libressl/portable"
},
{
"name": "VulnCheck Advisory: LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-crlf-injection-via-aia-ocsp-url-path"
}
],
"title": "LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118372",
"datePublished": "2026-10-28T02:03:20.849Z",
"dateReserved": "2026-10-28T01:19:20.199Z",
"dateUpdated": "2026-10-28T16:11:41.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118371 (GCVE-0-2026-118371)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
Summary
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Severity
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/openbsd/src/commit/d3f7195f484… | patch |
| https://github.com/openbsd/src/blob/3903c41d301d6… | technical-description |
| https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libr… | release-notes |
| https://github.com/libressl/portable | product |
| https://www.vulncheck.com/advisories/libressl-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libressl/portable",
"product": "LibreSSL",
"repo": "https://github.com/libressl/portable",
"vendor": "OpenBSD",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Theo Buehler"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate\u0027s Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:20.152Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/openbsd/src/commit/d3f7195f4849d8a699cea4a3a67677f4b3dc1591"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openbsd/src/blob/3903c41d301d66facec69f7bf776b182cbc5ed62/lib/libcrypto/ocsp/ocsp_ht.c#L184"
},
{
"name": "LibreSSL 4.4.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt"
},
{
"tags": [
"product"
],
"url": "https://github.com/libressl/portable"
},
{
"name": "VulnCheck Advisory: LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libressl-through-4.4.0-crlf-injection-via-ocsp-sendreq-new-request-line"
}
],
"title": "LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118371",
"datePublished": "2026-10-28T02:03:20.152Z",
"dateReserved": "2026-10-28T01:19:19.814Z",
"dateUpdated": "2026-10-28T02:03:20.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116237 (GCVE-0-2026-116237)
Vulnerability from cvelistv5 – Published: 2026-10-26 09:15 – Updated: 2026-10-26 09:15
VLAI
EPSS
VEX
Title
Oray Pugongying X5 Pro Dnsmasq crlf injection
Summary
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426286 | vdb-entry |
| https://vuldb.com/vuln/426286/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116237 | third-party-advisory |
| https://vuldb.com/submit/1005085 | third-party-advisory |
| https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oray | Pugongying X5 Pro |
Affected:
7.6.1
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"Dnsmasq"
],
"product": "Pugongying X5 Pro",
"vendor": "Oray",
"versions": [
{
"status": "affected",
"version": "7.6.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FirmHarness (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CRLF Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T09:15:17.500Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426286 | Oray Pugongying X5 Pro Dnsmasq crlf injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426286"
},
{
"name": "VDB-426286 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426286/cti"
},
{
"name": "CVE-2026-116237 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116237"
},
{
"name": "Submit #1005085 | Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1005085"
},
{
"tags": [
"exploit"
],
"url": "https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-DNS-Group-Newline-Injection-Runs-a-Root-Script-3ea797159f158048a73bf3ba23ccefdb"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:26:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "Oray Pugongying X5 Pro Dnsmasq crlf injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116237",
"datePublished": "2026-10-26T09:15:17.500Z",
"dateReserved": "2026-10-25T15:20:34.507Z",
"dateUpdated": "2026-10-26T09:15:17.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116235 (GCVE-0-2026-116235)
Vulnerability from cvelistv5 – Published: 2026-10-26 08:45 – Updated: 2026-10-26 16:33
VLAI
EPSS
VEX
Title
Oray Pugongying X5 Pro L2TP Authentication crlf injection
Summary
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
9.1 (Critical)
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 16:06 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426284 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426284/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116235 | third-party-advisory |
| https://vuldb.com/submit/1005083 | third-party-advisory |
| https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oray | Pugongying X5 Pro |
Affected:
7.6.1
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116235",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T16:06:25.859071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:33:05.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"L2TP Authentication"
],
"product": "Pugongying X5 Pro",
"vendor": "Oray",
"versions": [
{
"status": "affected",
"version": "7.6.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FirmHarness (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CRLF Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T08:45:16.165Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426284 | Oray Pugongying X5 Pro L2TP Authentication crlf injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426284"
},
{
"name": "VDB-426284 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426284/cti"
},
{
"name": "CVE-2026-116235 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116235"
},
{
"name": "Submit #1005083 | Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1005083"
},
{
"tags": [
"exploit"
],
"url": "https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-L2TP-Username-Injection-3ea797159f158012be0af2ca84d1ee2b"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:25:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "Oray Pugongying X5 Pro L2TP Authentication crlf injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116235",
"datePublished": "2026-10-26T08:45:16.165Z",
"dateReserved": "2026-10-25T15:20:27.435Z",
"dateUpdated": "2026-10-26T16:33:05.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116234 (GCVE-0-2026-116234)
Vulnerability from cvelistv5 – Published: 2026-10-26 08:30 – Updated: 2026-10-26 08:30
VLAI
EPSS
VEX
Title
Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
Summary
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
9.1 (Critical)
9.1 (Critical)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426283 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426283/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116234 | third-party-advisory |
| https://vuldb.com/submit/1005082 | third-party-advisory |
| https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oray | Pugongying X5 Pro |
Affected:
7.6.1
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"IPsec Policy Handler"
],
"product": "Pugongying X5 Pro",
"vendor": "Oray",
"versions": [
{
"status": "affected",
"version": "7.6.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FirmHarness (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CRLF Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T08:30:20.627Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426283 | Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426283"
},
{
"name": "VDB-426283 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426283/cti"
},
{
"name": "CVE-2026-116234 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116234"
},
{
"name": "Submit #1005082 | Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1005082"
},
{
"tags": [
"exploit"
],
"url": "https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-IPsec-secproto-Injection-3ea797159f1580919c5dea13e5baea84"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:25:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116234",
"datePublished": "2026-10-26T08:30:20.627Z",
"dateReserved": "2026-10-25T15:20:23.531Z",
"dateUpdated": "2026-10-26T08:30:20.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116233 (GCVE-0-2026-116233)
Vulnerability from cvelistv5 – Published: 2026-10-26 08:15 – Updated: 2026-10-31 01:08
VLAI
EPSS
VEX
Title
Oray Pugongying X5 Pro Dnsmasq crlf injection
Summary
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
9.1 (Critical)
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 01:08 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426282 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426282/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116233 | third-party-advisory |
| https://vuldb.com/submit/1005081 | third-party-advisory |
| https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oray | Pugongying X5 Pro |
Affected:
7.6.1
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T01:08:29.768359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T01:08:40.753Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"Dnsmasq"
],
"product": "Pugongying X5 Pro",
"vendor": "Oray",
"versions": [
{
"status": "affected",
"version": "7.6.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FirmHarness (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CRLF Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T08:15:14.847Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426282 | Oray Pugongying X5 Pro Dnsmasq crlf injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426282"
},
{
"name": "VDB-426282 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426282/cti"
},
{
"name": "CVE-2026-116233 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116233"
},
{
"name": "Submit #1005081 | Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1005081"
},
{
"tags": [
"exploit"
],
"url": "https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Dnsmasq-Directive-Injection-Through-DHCP-Lease-Time-3ea797159f1580979394d23087844670"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:25:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "Oray Pugongying X5 Pro Dnsmasq crlf injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116233",
"datePublished": "2026-10-26T08:15:14.847Z",
"dateReserved": "2026-10-25T15:20:20.131Z",
"dateUpdated": "2026-10-31T01:08:40.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Avoid using CRLF as a special sequence.
Mitigation
Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.