cve-2021-44228-rce-poc

CVE-2021-44228 Remote Command Execution PoC This repository allows security researchers to experiment with remote code execution by offering an implementation of an attack server that loads a custom exploit on a vulnerable application that contains log4j. ⚠️ The tool is intended for self-assessmen...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

EUVD-2026-125780

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-9821

IBM Cyber Fraud versions 1.0.0 through 1.1.0 are vulnerable to a log injection flaw. The root cause is the improper neutralization of special elements when writing to log files, which could allow an unauthorized user to inject data into log messages . Exploitation details and specific remediation...

log4j

Log4J Zero-Day Compilation of log4j OSINT findings, including Detection, Attack Surface, Mitigation, IoCs. I. Overview Summary This vulnerability makes it possible for any attacker who can inject text into log messages or log message parameters into server logs to load code from a remote server...

CVE-2026-111211

A flaw was found in django. The geometry form field and its widgets directly log invalid user-submitted values without proper escaping. A remote attacker could exploit this by submitting input containing control characters, such as newlines or escape sequences, leading to log injection. This flaw...

CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

PT-2026-147203

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-93333 Vault audit device prefix vulnerable to log injection

Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading...

CVE-2026-93333

HashiCorp Vault contains a vulnerability where audit devices fail to validate the contents of a configured audit log prefix . Due to the lack of consistent enforcement of server-level restrictions, a privileged operator can inject content into audit logs. This could result in forged or misleading...

Vault audit device prefix vulnerable to log injection

Summary Vault’s audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or...

CVE-2025-20384

SPLUNK CVE-2025-20384 i dunno, i just read stuff my friendo sent to me and start typing down some random sorry ass nub javascript code Log Injection/Forgery/Poisoning/Obfuscate type POC Please read this arcticle OWASP Log Injection TL;DR Look for static file, passed it and append some random...

Updated python-django package fixes security vulnerabilities

CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload CVE-2026-111211: Potential log injection via unescaped geometry form values CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries CVE-2026-113593: Potential exposure of priva...

MGASA-2026-0591 Updated python-django package fixes security vulnerabilities

CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload CVE-2026-111211: Potential log injection via unescaped geometry form values CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries CVE-2026-113593: Potential exposure of priva...

Log4j-PoC

Proof of Concept for Log4j CVE-2021-44228 Disclaimer This project is only for educational purposes. Introduction This is a proof of concept of the log4j rce adapted from HyCraftHD. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

CVE-2025-1974

🚨 Log Injection Test via Ingress-NGINX Admission Controller 🧠 Overview This script tests for annotation injection vulnerabilities in Kubernetes clusters using the NGINX Ingress Controller. It is meant for detection purposes only in relation to CVE-2025-1974, which allows malicious annotations to...

CVE-2021-44228

🚨 CVE-2021-44228 — “Log4Shell” A critical remote code execution vulnerability in Apache Log4j 2 , widely known as Log4Shell. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Exploitation & Impact Real-World Impact Detection Mitigation & Fixes Summary 🔎 Overview...

Python Library Django 5.2.x < 5.2.19 / 6.0.x < 6.0.10 / 6.1.x < 6.1.3 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.19, or 6.0.x prior to 6.0.10, or 6.1.x prior to 6.1.3. It is, therefore, affected by multiple vulnerabilities, including: - django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definition...

CVE-2026-84439

A flaw was found in Apache ZooKeeper. When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into the audit log. This is achieved by sending a digest authentication request with tab characters embedded in the username, or by a client calling setACL with crafted...