1167 matches found
nextjs-middleware-auth-bypass-lab
Bypass de autorización del middleware de Next.js CVE-2025-29927 ¿Qué es la vulnerabilidad? En las aplicaciones Next.js, el middleware se ejecuta antes de que las solicitudes lleguen a la aplicación y realiza controles como la autenticación y la autorización. En la vulnerabilidad CVE-2025-29927,...
CVE-2026-Mastodon-Streaming-CRLF-Injection
CVE-2026-XXXXX: Mastodon Streaming Server — HTTP 响应头注入（CRLF 注入） 漏洞概览 项目| 详情 ---|--- CVE 编号| CVE-2026-XXXXX 影响产品| Mastodon（流媒体服务器） 影响版本| ≤ 4.5.9 漏洞文件| streaming/index.js 第 188–206 行 漏洞类型| HTTP 响应头注入 / CRLF 注入 CWE| CWE-74：输出特殊元素不当中和 CVSS 3.1| 6.5（中危） 攻击方式| 网络远程，无需认证 漏洞描述 当 WebSocket...
CVE-2017-5638
CVE-2017-5638 该脚本用于验证 Apache Struts 2 漏洞（CVE-2017-5638），又名 Struts-Shock。它完全无害，因为它不会注入任何恶意负载，仅注入一个名为 'STRUTS2-VALIDATION' 的 HTTP 请求头，以便能够验证目标是否易受攻击。 由于其多线程能力，它能够在不到 10 分钟内运行遍布全球的 2500 多个应用程序。因此，它在验证大型企业应用程序时非常方便。 cve-2017-5638 cve-2017-5638 易受攻击站点示例 该项目旨在展示 CVE-2017-5638 的利用方式，仅供教育目的。 更多信息，请参见...
CVE-2026-105324
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...
CVE-2026-105324
An HTTP header injection vulnerability exists in the start-page-loader.cgi component of ADM . This flaw allows an unauthenticated remote attacker to read arbitrary files on the host system by sending a crafted HTTP request with injected headers via the state parameter . The attacker can exploit t...
EUVD-2026-94153
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...
CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...
CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...
PT-2026-107335
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
CVE-2025-60876
CVE-2025-60876: corrección de inyección en request-target de busybox wget Una corrección que preserva el comportamiento para CVE-2025-60876, una vulnerabilidad de inyección de cabeceras HTTP en BusyBox wget, junto con la prueba de concepto que la demuestra y los artefactos para enviar la correcci...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
CVE-2017-5638
CVE-2017-5638 该脚本用于验证 Apache Struts 2 漏洞（CVE-2017-5638），又称 Struts-Shock。它完全无害，不会注入任何恶意负载，仅注入一个名为 'STRUTS2-VALIDATION' 的 HTTP 头，以便验证是否存在漏洞。 由于其多线程能力，它能够在不到10分钟内运行全球范围内的2500多个应用程序。因此，它对于大规模验证企业应用程序非常方便。 用法 运行此脚本有两种方式：带线程和不带线程，唯一的区别在于执行时间。要启用线程功能，只需传递线程参数即可。 第一个参数必须是一个包含所有目标 URL 的 TXT 文件，每行一个。请注意，这些...
log4jcheck
Northwave Log4j CVE-2021-44228 检测工具 2021年12月10日（星期五），一个针对 Java 库 'log4j' 2 中远程代码执行（RCE）漏洞的概念验证 1 被发布。此漏洞并未提前向软件开发者披露。该漏洞被追踪为 CVE-2021-44228 3。更多关于该漏洞的信息可在 Northwave Threat Response 4 中找到。 Northwave 创建了一个测试脚本，通过在常见 HTTP 头部中注入 payload 以及作为 HTTP GET 请求的一部分来检查存在漏洞的系统。通过监听包含为目标特制 UUID 的入站 DNS...
CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-
Aviso de Seguridad: Inyección en Cabeceras HTTP mediante CR y LF sin Validar en Valores de Cabecera tinyhttp ID de CVE asignado: CVE-2026-66753 Resumen tinyhttp no rechaza el retorno de carro ni el avance de línea dentro de los valores de las cabeceras HTTP, en ninguna de las dos direcciones. En ...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...