Monthly
Unauthenticated arbitrary file read affects ASUSTOR ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21, where a single crafted HTTP request to start-page-loader.cgi injects headers through the state parameter and abuses the underlying web server's X-Sendfile mechanism to return the contents of sensitive files on the host. No credentials or user interaction are required and default configurations are exploitable, making internet-exposed NAS web interfaces the highest-risk deployment, while LAN-only devices require attacker network presence; the flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis. The independent assessment rates this as a genuinely high-priority confidentiality-only flaw (CVSS 3.1 scope-changed, C:H/I:N/A:N; CVSS 4.0 base 9.2) rather than a CVSS-inflated one.
Stored cross-site scripting in Sachertortephp (MISP's CakePHP-derived framework) lets an authenticated user who can control an attachment filename inject CR/LF or a double quote into the Content-Disposition header generated by CakeResponse::download(). A CR/LF causes PHP to drop the entire Content-Disposition header so the response body renders inline with its own Content-Type on the application origin, while a double quote permits injection of additional Content-Disposition parameters; the payload is stored via attribute downloads, proposal downloads, or restSearch exports and executes when another authenticated user views the affected page. No public exploit code has been identified at time of analysis; an upstream fix is available via vendor commits.
HTTP response splitting and header injection in Sanic let unauthenticated remote attackers forge arbitrary response headers - and potentially split a response into two - when a Sanic application reflects attacker-controlled data into response.headers, the filename argument of file(..., filename=...), or cookie path/domain attributes. The flaw affects all Sanic releases prior to 24.12.1 as well as version 25.12.0, and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) with integrity impact dominant, since a successful injection can enable session fixation through injected cookies, cache poisoning, or corruption of security headers such as CSP or HSTS. No public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); realized impact still depends heavily on intermediate proxy and cache behavior and on whether the application actually exposes an injection sink.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
HTTP response header injection in CrowCpp Crow through v1.3.1 allows remote attackers to inject arbitrary CR/LF sequences into response headers when application code passes unvalidated input to header-setting APIs. The flaw stems from the framework not stripping \r\n characters in header keys or values, enabling CRLF injection that can lead to response splitting, cache poisoning, or XSS depending on how the embedding application uses user input. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the upstream fix in PR #1167 confirms the issue and provides a sanitization routine.
Prototype pollution in Axios 1.x (prior to 1.15.1) and 0.x (prior to 0.31.1) enables HTTP header injection attacks when any dependency in the application pollutes Object.prototype with specific properties (getHeaders, append, pipe, on, once, Symbol.toStringTag). Attackers exploit the HTTP adapter's duck-type checking to inject arbitrary headers into outbound HTTP requests, potentially leading to authentication bypass, session hijacking, or cache poisoning. EPSS data unavailable; no confirmed active exploitation (CISA KEV) at time of analysis. Publicly available exploit code exists per vendor advisory GHSA-6chq-wfr3-2hj9.
SMTP header injection in Serendipity CMS allows remote unauthenticated attackers to inject arbitrary email headers via malicious Host header during email-triggering operations (comments, subscriptions, password resets). The unsanitized $_SERVER['HTTP_HOST'] value is embedded directly into Message-ID headers without validation, enabling BCC injection, email spoofing, and reply hijacking. CVSS 7.2 with Changed scope indicates cross-domain impact. EPSS data not available; no public exploit identified at time of analysis, though a detailed proof-of-concept exists in the GitHub security advisory demonstrating successful header injection via comment submission.
Request-line injection in cpp-httplib 0.29.0 through 0.50.x lets a caller-controlled path that reaches Client::open_stream() - or any client path when set_path_encode(false) is in effect, such as a decoded redirect Location - carry raw CR/LF bytes into detail::write_request_line() and split the outbound HTTP/1.1 request line, injecting attacker-shaped request metadata that a downstream backend or intermediary may honor. The library itself requires no authentication (CVSS vector PR:N), but practical exploitation needs two coinciding conditions: the embedding application must forward remote input into that unsanitized path, and the receiving server or proxy must interpret the injected bytes as header or request boundaries. Impact is integrity-only (I:L) with no confidentiality or availability effect, no public exploit code has been identified at time of analysis, and the vendor fix is released in 0.51.0, making this a low-priority defense-in-depth issue rather than an urgent threat.
Unauthenticated arbitrary file read affects ASUSTOR ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21, where a single crafted HTTP request to start-page-loader.cgi injects headers through the state parameter and abuses the underlying web server's X-Sendfile mechanism to return the contents of sensitive files on the host. No credentials or user interaction are required and default configurations are exploitable, making internet-exposed NAS web interfaces the highest-risk deployment, while LAN-only devices require attacker network presence; the flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis. The independent assessment rates this as a genuinely high-priority confidentiality-only flaw (CVSS 3.1 scope-changed, C:H/I:N/A:N; CVSS 4.0 base 9.2) rather than a CVSS-inflated one.
Stored cross-site scripting in Sachertortephp (MISP's CakePHP-derived framework) lets an authenticated user who can control an attachment filename inject CR/LF or a double quote into the Content-Disposition header generated by CakeResponse::download(). A CR/LF causes PHP to drop the entire Content-Disposition header so the response body renders inline with its own Content-Type on the application origin, while a double quote permits injection of additional Content-Disposition parameters; the payload is stored via attribute downloads, proposal downloads, or restSearch exports and executes when another authenticated user views the affected page. No public exploit code has been identified at time of analysis; an upstream fix is available via vendor commits.
HTTP response splitting and header injection in Sanic let unauthenticated remote attackers forge arbitrary response headers - and potentially split a response into two - when a Sanic application reflects attacker-controlled data into response.headers, the filename argument of file(..., filename=...), or cookie path/domain attributes. The flaw affects all Sanic releases prior to 24.12.1 as well as version 25.12.0, and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) with integrity impact dominant, since a successful injection can enable session fixation through injected cookies, cache poisoning, or corruption of security headers such as CSP or HSTS. No public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); realized impact still depends heavily on intermediate proxy and cache behavior and on whether the application actually exposes an injection sink.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
HTTP response header injection in CrowCpp Crow through v1.3.1 allows remote attackers to inject arbitrary CR/LF sequences into response headers when application code passes unvalidated input to header-setting APIs. The flaw stems from the framework not stripping \r\n characters in header keys or values, enabling CRLF injection that can lead to response splitting, cache poisoning, or XSS depending on how the embedding application uses user input. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the upstream fix in PR #1167 confirms the issue and provides a sanitization routine.
Prototype pollution in Axios 1.x (prior to 1.15.1) and 0.x (prior to 0.31.1) enables HTTP header injection attacks when any dependency in the application pollutes Object.prototype with specific properties (getHeaders, append, pipe, on, once, Symbol.toStringTag). Attackers exploit the HTTP adapter's duck-type checking to inject arbitrary headers into outbound HTTP requests, potentially leading to authentication bypass, session hijacking, or cache poisoning. EPSS data unavailable; no confirmed active exploitation (CISA KEV) at time of analysis. Publicly available exploit code exists per vendor advisory GHSA-6chq-wfr3-2hj9.
SMTP header injection in Serendipity CMS allows remote unauthenticated attackers to inject arbitrary email headers via malicious Host header during email-triggering operations (comments, subscriptions, password resets). The unsanitized $_SERVER['HTTP_HOST'] value is embedded directly into Message-ID headers without validation, enabling BCC injection, email spoofing, and reply hijacking. CVSS 7.2 with Changed scope indicates cross-domain impact. EPSS data not available; no public exploit identified at time of analysis, though a detailed proof-of-concept exists in the GitHub security advisory demonstrating successful header injection via comment submission.
Request-line injection in cpp-httplib 0.29.0 through 0.50.x lets a caller-controlled path that reaches Client::open_stream() - or any client path when set_path_encode(false) is in effect, such as a decoded redirect Location - carry raw CR/LF bytes into detail::write_request_line() and split the outbound HTTP/1.1 request line, injecting attacker-shaped request metadata that a downstream backend or intermediary may honor. The library itself requires no authentication (CVSS vector PR:N), but practical exploitation needs two coinciding conditions: the embedding application must forward remote input into that unsanitized path, and the receiving server or proxy must interpret the injected bytes as header or request boundaries. Impact is integrity-only (I:L) with no confidentiality or availability effect, no public exploit code has been identified at time of analysis, and the vendor fix is released in 0.51.0, making this a low-priority defense-in-depth issue rather than an urgent threat.