Search Vulnerabilities

Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v

Kirby: Request header injection in `Http\Remote`

WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

Net::IMAP: Command Injection via ID command argument

Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

AIOHTTP: CRLF injection in multipart headers

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier

guzzlehttp/psr7 has CRLF Injection via URI Host Component

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections

Multipart form-data header injection in Req via unescaped name/filename/content_type

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags