tag
Header-Injection
Apache Traffic Server Internal @Header Metadata Spoofing (CVE-2026-33267)
CVE-2026-33267 is an internal metadata spoofing vulnerability in Apache Traffic Server. ATS uses @-prefixed headers (e.g., @Ats-Internal, @ICAP-Status, @TCPInfo) as internal metadata that lives in the in-memory header structure but is never serialized on the…
CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Authentication Bypass (vamp-forticheck Scanner)
CVE-2022-40684 is an authentication-bypass vulnerability in the web management interface of FortiOS, FortiProxy, and FortiSwitchManager that allows an unauthenticated remote attacker to access the administrative REST API. The affected firmware fails to…
camel-coap Header Injection → RCE Self-Contained Reproducer (CVE-2026-33453)
Apache Camel's camel-coap component copies CoAP request URI query parameters directly into Camel Exchange headers inside CamelCoapResource.handleRequest(), without applying any HeaderFilterStrategy. Because CoAPEndpoint extends DefaultEndpoint (not…
MagicMirror² Unauthenticated SSRF via `/cors` Endpoint (CVE-2026-42281)
MagicMirror²'s /cors endpoint is designed to proxy cross-origin requests on behalf of the browser, but it performs no validation or allowlisting of the target URL and forwards attacker-controlled headers in both directions. This turns the endpoint into a…
CRLF Email Header Injection in Plunk via Raw MIME Construction (CVE-2026-34975)
Plunk's POST /v1/send endpoint builds a raw MIME email message by interpolating user-supplied fields (from.name, subject, custom headers, attachment filenames) directly into a template string without sanitizing CRLF (\r\n) sequences. An authenticated API user…
Apache Camel camel-coap Header Injection to Remote Code Execution (CVE-2026-33453)
Apache Camel's camel-coap component maps CoAP URI query parameters directly into Camel Exchange headers via setHeader() inside CamelCoapResource.handleRequest(), without applying any HeaderFilterStrategy. Because CoAPEndpoint extends DefaultEndpoint rather…
Apache APISIX forward-auth CRLF Header Injection — CVE-2026-31908
Apache APISIX's forward-auth plugin fails to sanitize CRLF (\r\n) sequences in inbound request headers before forwarding an authentication check upstream. By injecting CRLF sequences into headers such as Authorization, X-Forwarded-For, or Host, an…
Next.js Corrupt Middleware Auth Bypass (CVE-2025-29927)
CVE-2025-29927 is a critical authentication bypass in Next.js middleware. By sending a crafted x-middleware-subrequest HTTP header, an unauthenticated remote attacker can cause the Next.js middleware layer to skip execution entirely — bypassing authentication…