CVE-2026-1337

CVE-2026-1337 - Neo4j - ログ注入 認証済みユーザーによるログ注入は、Neo4j が json 形式に設定されて いない 場合に、Neo4j の query.log で可能です。 概要 Neo4j は bolt トランザクションのメタデータフィールド内の制御文字をエスケープしません。認証済みユーザーは、改行（\n）を注入して偽のログエントリを注入するために、制御文字を送信できます。 添付の POC コードでは、これらのクエリがどちらも正当に見える形で query.log...

CVE-2023-26469-Jorani

CVE-2023-26469 エクスプロイトツール 概要 これは、Jorani 1.0.0 を対象としたエクスプロイトツール（PoC）です。この脆弱性により、攻撃者はパストラバーサルとログ注入の技術を利用して、リモートコード実行（RCE）を実現できます。 ⚠️ 警告：このツールはセキュリティ研究および許可されたテストのみを目的としています。許可なくこのツールを使用した攻撃は違法です。 脆弱性の説明 CVE-2023-26469 は、Jorani 1.0.0 における深刻なセキュリティ脆弱性であり、以下の2つの攻撃ベクトルを組み合わせたものです。 1. ログ注入...

Log4j-PoC

Log4j（CVE-2021-44228）の概念実証 免責事項 このプロジェクトは教育目的のみです。 はじめに これは HyCraftHD から流用した log4j RCE の概念実証です。 CVE-2021-44228 に関するリンクは以下の通りです： https://www.lunasec.io/docs/blog/log4j-zero-day https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/apache/logging-log4j2/pull/608...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 SAP NetWeaver AS JAVA CRM上のログインジェクションを介したリモートコマンド実行のPoC スクリプト使用例 python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true ここで --host はSAPサーバーのIP --port SAP NetWeaver AS Javaのポート...

pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

CVE-2026-96561

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-47562

A flaw was found in the NVIDIA GPU Display Driver for Linux. The driver's kernel mode layer fails to properly sanitize user-supplied version strings, allowing a local user to inject crafted text into the kernel log. A successful exploit can lead to log data tampering and a Denial of Service DoS...

EUVD-2026-90184

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47562

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47562

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2025-20384

SPLUNK CVE-2025-20384 なぜか知らないけど、友達が送ってきたものを読んで、適当なJavaScriptコードを打ち始めた。 Log Injection/Forgery/Poisoning/Obfuscate type POC この記事をお読みください OWASP Log Injection TL;DR 静的ファイルを探し、それを渡してランダムなパラメータを追加する そこで、以下のように実行する。curl -k...

Linux Distros Unpatched Vulnerability : CVE-2026-47562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the...

CVE-2021-44228

🚨 CVE-2021-44228 — 「Log4Shell」 Apache Log4j 2 における深刻なリモートコード実行の脆弱性であり、広く Log4Shell として知られています。 📖 目次 概要 技術的詳細 深刻度とCVSS 影響を受けるバージョン 悪用と影響 実際の影響 検出 対策と修正 まとめ 🔎 概要 CVE-2021-44228 は、2021年12月に発見された Apache Log4j 2.x （2.15.0 未満）における深刻なRCE脆弱性です。 この脆弱性により、認証されていないリモート攻撃者が、Log4j...

GHSA-9F6G-J8CH-79G4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

EUVD-2026-76027

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields...

NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields vulnerability discovered by ? in WordPress Npm morgan versions 1.12.1...

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

CVE-2026-84501

A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log...