CVE-2026-21876

This repository contains a functional PoC for CVE-2026-21876, demonstrating a WAF bypass in OWASP CRS via a crafted multipart/form-data request with a non-standard charset (utf-7). The exploit leverages improper charset handling to bypass input validation.

This repository contains a proof-of-concept for CVE-2026-21876, demonstrating a WAF bypass via a multipart/form-data charset manipulation technique. The exploit leverages a non-standard charset (utf-7) to encode malicious payloads, bypassing OWASP CRS WAF rules.

This repository provides a lab environment for CVE-2026-21876, demonstrating an XSS vulnerability in a Flask application. The exploit involves crafting a malicious multipart/form-data request to bypass WAF protections and execute arbitrary JavaScript.

This repository contains a functional PoC for CVE-2026-21876, demonstrating a WAF bypass in OWASP CRS via a crafted multipart/form-data request using a non-standard charset (utf-7) to evade detection. The included Docker setup provides a test environment with a vulnerable OWASP ModSecurity CRS instance and a Flask backend to validate the bypass.