pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

CVE-2026-1337

CVE-2026-1337 - Neo4j - Inyección de logs Un usuario autenticado puede realizar inyección de logs en el query.log de Neo4j cuando Neo4j no está configurado para usar formato json. Resumen Neo4j no escapa los caracteres de control en el campo de metadatos cuando forma parte de una transacción bolt...

Log4j-PoC

Prueba de concepto para Log4j CVE-2021-44228 Aviso legal Este proyecto es solo con fines educativos. Introducción Esta es una prueba de concepto del RCE de Log4j adaptada de HyCraftHD. Aquí hay algunos enlaces para el CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

CVE-2018-2380

CVE-2018-2380 Puntuación base CVSS v3: 6.6/10 PoC de ejecución remota de comandos mediante inyección de logs en SAP NetWeaver AS JAVA CRM Ejemplo de uso del script root@kitploit: python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0...

log4j

Log4J Zero-Day Recopilación de hallazgos de OSINT sobre log4j, incluyendo Detección, Superficie de Ataque, Mitigación e IoCs. I. Resumen Resumen Esta vulnerabilidad permite que cualquier atacante que pueda inyectar texto en mensajes de registro o en parámetros de mensajes de registro en los logs...

CVE-2025-1974

🚨 Prueba de Inyección de Registros a través del Controlador de Admisión de Ingress-NGINX 🧠 Resumen Este script prueba vulnerabilidades de inyección de anotaciones en clústeres de Kubernetes que utilizan el Controlador de Ingress NGINX. Está diseñado solo para fines de detección en relación con...

CVE-2023-26469-Jorani

CVE-2023-26469 漏洞利用工具 概述 这是一个针对 Jorani 1.0.0 版本的漏洞利用工具（PoC），该漏洞允许攻击者通过路径遍历和日志注入技术实现远程代码执行。 ⚠️ 警告：此工具仅用于安全研究和授权测试。未经授权使用此工具进行攻击是非法的。 漏洞描述 CVE-2023-26469 是 Jorani 1.0.0 中的一个严重安全漏洞，结合了以下两个攻击向量： 1. 日志注入 ：通过登录表单向应用程序日志文件注入恶意 PHP 代码 2. 路径遍历 ：利用路径遍历漏洞访问并执行被注入的日志文件 攻击者可以利用这个漏洞在目标服务器上执行任意系统命令。 功能特性 自动获取...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...

EUVD-2026-76027

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

Linux Distros Unpatched Vulnerability : CVE-2026-87859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...

PT-2026-89814

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames

A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed CRLF sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-bas...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames

A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed CRLF sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-bas...

EUVD-2026-74936

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2025-20384

SPLUNK CVE-2025-20384 嗯，我只是读了我朋友发给我的东西，然后开始胡乱敲一些蹩脚的菜鸟 javascript 代码 日志注入/伪造/投毒/混淆类型 POC 请阅读这篇文章 OWASP Log Injection TL;DR 寻找静态文件，传递它并附加一些随机参数 所以，我执行 curl -k...

CVE-2025-46808

An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5...

CVE-2025-46808

SUSE NeuVector manager (versions before 5.4.5 ) is affected by an Insertion of Sensitive Information into Log File vulnerability, where sensitive data is exposed in the manager container's log. The CVSS v3.1 base score is 6.8 (Medium) with a High confidentiality impact but no integrity or availab...