CVE-2026-1337

CVE-2026-1337 - Neo4j - 日志注入 当 Neo4j 未 配置为 JSON 格式时，经过身份验证的用户可以在 Neo4j 的 query.log 中执行日志注入。 概述 Neo4j 在 bolt 事务的元数据字段中没有转义控制字符。经过身份验证的用户可以发送控制字符，通过注入换行符 \n 来伪造日志条目。 在附带的 POC 代码中，这些查询被添加到 query.log，看起来都合法，但实际上只有第一个是真实的。由于注入，日志中还会出现一些格式错误的其他痕迹。 MATCH n:RealQuery RETURN n LIMIT 1 MATCH n:FakeQuery1...

CVE-2023-26469-Jorani

CVE-2023-26469 漏洞利用工具 概述 这是一个针对 Jorani 1.0.0 版本的漏洞利用工具（PoC），该漏洞允许攻击者通过路径遍历和日志注入技术实现远程代码执行。 ⚠️ 警告：此工具仅用于安全研究和授权测试。未经授权使用此工具进行攻击是非法的。 漏洞描述 CVE-2023-26469 是 Jorani 1.0.0 中的一个严重安全漏洞，结合了以下两个攻击向量： 1. 日志注入 ：通过登录表单向应用程序日志文件注入恶意 PHP 代码 2. 路径遍历 ：利用路径遍历漏洞访问并执行被注入的日志文件 攻击者可以利用这个漏洞在目标服务器上执行任意系统命令。 功能特性 自动获取...

Log4j-PoC

Prueba de concepto para Log4j CVE-2021-44228 Aviso legal Este proyecto es solo con fines educativos. Introducción Esta es una prueba de concepto del RCE de Log4j adaptada de HyCraftHD. Aquí hay algunos enlaces para el CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

CVE-2018-2380

CVE-2018-2380 CVSS v3 基础评分：6.6/10 通过 SAP NetWeaver AS JAVA CRM 的日志注入实现远程命令执行的 PoC 脚本使用示例 python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true 其中 --host 是 SAP 服务器 IP --port SAP NetWeaver AS Java 端口 可通过 SAP Redwood 目录遍历漏洞获取...

pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

CVE-2026-96561

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-47562

A flaw was found in the NVIDIA GPU Display Driver for Linux. The driver's kernel mode layer fails to properly sanitize user-supplied version strings, allowing a local user to inject crafted text into the kernel log. A successful exploit can lead to log data tampering and a Denial of Service DoS...

EUVD-2026-90184

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47562

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47562

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2025-20384

SPLUNK CVE-2025-20384 嗯，我只是读了我朋友发给我的东西，然后开始胡乱敲一些蹩脚的菜鸟 javascript 代码 日志注入/伪造/投毒/混淆类型 POC 请阅读这篇文章 OWASP Log Injection TL;DR 寻找静态文件，传递它并附加一些随机参数 所以，我执行 curl -k...

Linux Distros Unpatched Vulnerability : CVE-2026-47562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the...

CVE-2021-44228

🚨 CVE-2021-44228 — “Log4Shell” Apache Log4j 2 中的一个关键远程代码执行漏洞，广泛被称为 Log4Shell 。 📖 目录 概述 技术细节 严重性与 CVSS 受影响版本 利用与影响 现实世界影响 检测 缓解与修复 总结 🔎 概述 CVE-2021-44228 是 :contentReferenceoaicite:0index=0 版本 2.x （2.15.0 之前）中的一个关键 RCE 漏洞，于 2021 年 12 月被发现。 它允许未认证的远程攻击者通过向被 Log4j...

GHSA-9F6G-J8CH-79G4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

EUVD-2026-76027

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields...

NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields vulnerability discovered by ? in WordPress Npm morgan versions 1.12.1...

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

CVE-2026-84501

A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log...