pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

CVE-2026-93333 Vault audit device prefix vulnerable to log injection

Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading...

CVE-2026-93333

HashiCorp Vault contains a vulnerability where audit devices fail to validate the contents of a configured audit log prefix . Due to the lack of consistent enforcement of server-level restrictions, a privileged operator can inject content into audit logs. This could result in forged or misleading...

Vault audit device prefix vulnerable to log injection

Summary Vault’s audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or...

CVE-2025-20384

SPLUNK CVE-2025-20384 i dunno, i just read stuff my friendo sent to me and start typing down some random sorry ass nub javascript code Log Injection/Forgery/Poisoning/Obfuscate type POC Please read this arcticle OWASP Log Injection TL;DR Look for static file, passed it and append some random...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

MGASA-2026-0591 Updated python-django package fixes security vulnerabilities

CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload CVE-2026-111211: Potential log injection via unescaped geometry form values CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries CVE-2026-113593: Potential exposure of priva...

Updated python-django package fixes security vulnerabilities

CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload CVE-2026-111211: Potential log injection via unescaped geometry form values CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries CVE-2026-113593: Potential exposure of priva...

Log4j-PoC

Proof of Concept for Log4j CVE-2021-44228 Disclaimer This project is only for educational purposes. Introduction This is a proof of concept of the log4j rce adapted from HyCraftHD. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

CVE-2025-1974

🚨 Log Injection Test via Ingress-NGINX Admission Controller 🧠 Overview This script tests for annotation injection vulnerabilities in Kubernetes clusters using the NGINX Ingress Controller. It is meant for detection purposes only in relation to CVE-2025-1974, which allows malicious annotations to...

CVE-2021-44228

🚨 CVE-2021-44228 — “Log4Shell” A critical remote code execution vulnerability in Apache Log4j 2 , widely known as Log4Shell. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Exploitation & Impact Real-World Impact Detection Mitigation & Fixes Summary 🔎 Overview...

cve-2021-44228-rce-poc

CVE-2021-44228 Remote Command Execution PoC This repository allows security researchers to experiment with remote code execution by offering an implementation of an attack server that loads a custom exploit on a vulnerable application that contains log4j. ⚠️ The tool is intended for self-assessmen...

log4j

Log4J Zero-Day Compilation of log4j OSINT findings, including Detection, Attack Surface, Mitigation, IoCs. I. Overview Summary This vulnerability makes it possible for any attacker who can inject text into log messages or log message parameters into server logs to load code from a remote server...

CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

Python Library Django 5.2.x < 5.2.19 / 6.0.x < 6.0.10 / 6.1.x < 6.1.3 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.19, or 6.0.x prior to 6.0.10, or 6.1.x prior to 6.1.3. It is, therefore, affected by multiple vulnerabilities, including: - django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definition...

CVE-2026-84439

A flaw was found in Apache ZooKeeper. When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into the audit log. This is achieved by sending a digest authentication request with tab characters embedded in the username, or by a client calling setACL with crafted...

CVE-2026-103864

Apache Sling Engine versions before 3.0.4 are vulnerable to an improper output neutralization for logs (CWE-117). The root cause involves request-derived values reaching log sinks without proper CR/LF neutralization . This issue can impact the integrity of log files. Numerous packages, including ...

CVE-2026-103864 Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...

CVE-2026-103864 Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...

SUSE CVE-2026-111211

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize, used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attacker...