Monthly
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. No public exploit code has been identified at time of analysis, and the issue is fixed in release 1.3.0.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
Header injection vulnerability in tiny-http through version 0.12.0 allows attackers to inject CRLF bytes into HTTP header values, enabling response splitting, cache poisoning, and session fixation. No active exploitation reported, but proof-of-concept code is publicly available in a GitHub repository. The library's insufficient validation of header values enables this injection primitive against line-feed-tolerant backends.
HTTP response splitting in Rouille 0.4.0 to 3.6.2 allows remote attackers to inject arbitrary response headers. By embedding carriage return or line feed bytes into percent-decoded query parameters or Cookie header values, attackers can perform cache poisoning, session fixation, and override security policies like CSP or CORS. No active exploitation is confirmed, but proof-of-concept code may exist.
Cookie injection in Adminer before 5.4.3 allows network-accessible, unauthenticated attackers to manipulate Set-Cookie path attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header, enabling downgrade of SameSite protection and subsequent cross-origin authenticated requests against victim sessions. Exploitation is gated on a misconfigured reverse proxy that forwards attacker-controlled header values and requires passive user interaction (UI:P per CVSS 4.0), making this a realistic but non-trivial attack path. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch is available as version 5.4.3.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy captive portal authentication flows enables a man-in-the-middle attacker to inject arbitrary HTTP headers into intercepted authentication requests. Affected platforms span FortiOS 7.2-7.6.4 and FortiProxy 7.2-7.6.4. The CVSS temporal vector includes E:P, confirming proof-of-concept exploit code exists; however, no active exploitation has been confirmed via CISA KEV. The RL:O temporal indicator confirms an official remediation is available per vendor advisory FG-IR-26-153.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. No public exploit code has been identified at time of analysis, and the issue is fixed in release 1.3.0.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
Header injection vulnerability in tiny-http through version 0.12.0 allows attackers to inject CRLF bytes into HTTP header values, enabling response splitting, cache poisoning, and session fixation. No active exploitation reported, but proof-of-concept code is publicly available in a GitHub repository. The library's insufficient validation of header values enables this injection primitive against line-feed-tolerant backends.
HTTP response splitting in Rouille 0.4.0 to 3.6.2 allows remote attackers to inject arbitrary response headers. By embedding carriage return or line feed bytes into percent-decoded query parameters or Cookie header values, attackers can perform cache poisoning, session fixation, and override security policies like CSP or CORS. No active exploitation is confirmed, but proof-of-concept code may exist.
Cookie injection in Adminer before 5.4.3 allows network-accessible, unauthenticated attackers to manipulate Set-Cookie path attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header, enabling downgrade of SameSite protection and subsequent cross-origin authenticated requests against victim sessions. Exploitation is gated on a misconfigured reverse proxy that forwards attacker-controlled header values and requires passive user interaction (UI:P per CVSS 4.0), making this a realistic but non-trivial attack path. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch is available as version 5.4.3.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy captive portal authentication flows enables a man-in-the-middle attacker to inject arbitrary HTTP headers into intercepted authentication requests. Affected platforms span FortiOS 7.2-7.6.4 and FortiProxy 7.2-7.6.4. The CVSS temporal vector includes E:P, confirming proof-of-concept exploit code exists; however, no active exploitation has been confirmed via CISA KEV. The RL:O temporal indicator confirms an official remediation is available per vendor advisory FG-IR-26-153.