#CRLF Injection
All CosmicBytez Labs articles tagged #CRLF Injection, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-116233 — Oray Pugongying X5 Pro Dnsmasq CRLF Injection
A CVSS 9.1 CRLF injection in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1 via the rent_time argument. A public exploit exists; no fix is reported.
- Security
CVE-2026-116234 — Oray Pugongying X5 Pro IPsec Policy CRLF Injection
A CVSS 9.1 CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 via secproto in /etc/ipsec.conf. Public exploit; no fix reported.
- Security
CVE-2026-116235 — Oray Pugongying X5 Pro L2TP Authentication CRLF Injection
A CVSS 9.1 CRLF injection in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1 via the Username argument. Public exploit; no fix reported.
- Security
CVE-2026-75925: IXON VPN Client CRLF Injection Enables Root/SYSTEM Command Execution
IXON VPN Client before v1.4.7 lets a local attacker inject CRLF sequences into a config file consumed by a privileged process, gaining root or SYSTEM.
- Security
CVE-2026-82854: Nodemailer SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 lets attackers inject SMTP commands via unsanitized envelope.size, silently adding recipients to outbound mail.