Other injection.

Netty Redis Codec Encoder has a CRLF Injection Issue

• Other injection

>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final · fixed in 4.2.13.Final, 4.1.133.Final

Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

• Other injection

<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final · fixed in 4.1.133.Final, 4.2.13.Final

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

• Other injection

<4.12.16 · fixed in 4.12.16

ShellHub has crash-DoS via field injection in filter and sort-by parameters

• Other injection
• Denial of service

<0.24.2 · fixed in 0.24.2

wger: CSV/TSV formula injection in gym member export (first_name/last_name)

• Other injection

<2.6 · fixed in 2.6

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

• Other injection

<1.9.0 · fixed in 1.9.0

sse-channel: SSE Injection via unsanitized event fields

• Other injection

<4.0.1 · fixed in 4.0.1

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

• Other injection

<=29.0 · no fixed version yet

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

• Other injection

<6.13.9 || >=7.0.0, <7.8.9 || >=8.0.0, <8.22.1 || >=9.0.0, <9.1.6 · fixed in 6.13.9, 7.8.9, 8.22.1, 9.1.6

Kimai vulnerable to formula Injection via tag names in XLSX export

• Other injection

>=2.27.0, <2.54.0 · fixed in 2.54.0

Pi-hole FTL remote code execution via newline injection in dns.interface configuration

• pi-hole FTL
• Other injection

Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly

• Sandboxie
• Other injection

Microdot has HTTP response splitting in Response.set_cookie()

• Other injection

<2.6.1 · fixed in 2.6.1

Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

• Other injection
• HTTP request smuggling

<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final · fixed in 4.1.133.Final, 4.2.13.Final

EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection

• EFM ipTIME C200
• Other injection
• Command injection

traccar allows XML injection in KML and GPX exports

• traccar
• Other injection

traccar allows CSV formula injection via exported position data

• traccar
• Other injection

ERPGo SaaS 3.9 CSV Injection via Vendor Creation

• Rajodiya ERPGo SaaS
• Other injection

Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption

• Path traversal
• Other injection

<=0.22.0 · no fixed version yet

itsourcecode Courier Management System print_pdets.php sql injection

• itsourcecode Courier Management System
• Other injection
• SQL injection

54yyyu code-mcp MCP Tool server.py git_operation command injection

• 54yyyu code-mcp
• Other injection
• Command injection

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

• Other injection

>=1.0.0, <1.15.1 · fixed in 1.15.1

Axios: Header Injection via Prototype Pollution

• Other injection
• Prototype pollution

<0.31.1 || >=1.0.0, <1.15.1 · fixed in 0.31.1, 1.15.1

CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection

• CodeCanyon Perfex CRM
• Other injection
• SQL injection

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

• Command injection
• Other injection

<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.4.24, 0.5.14, 0.6.4

net-imap vulnerable to command Injection via unvalidated Symbol inputs

• Command injection
• Other injection

<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.4.24, 0.5.14, 0.6.4

SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection

• SourceCodester Web-based Pharmacy Product Management System
• Other injection
• SQL injection

CodeAstro Online Classroom facultydetails sql injection

• CodeAstro Online Classroom
• Other injection
• SQL injection

CodeAstro Online Classroom addnewstudent sql injection

• CodeAstro Online Classroom
• Other injection
• SQL injection

CodeAstro Online Classroom studentdetails sql injection

• CodeAstro Online Classroom
• Other injection
• SQL injection

CodeAstro Online Classroom facultylogin sql injection

• CodeAstro Online Classroom
• Other injection
• SQL injection

CodeAstro Online Classroom studentlogin sql injection

• CodeAstro Online Classroom
• Other injection
• SQL injection

Prefect Git Argument Injection in GitRepository Pull Steps

• Other injection
• Command injection

<3.6.25.dev7 · fixed in 3.6.25.dev7

code-projects BloodBank Managing System get_state.php sql injection

• code-projects BloodBank Managing System
• Other injection
• SQL injection

Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection

• Shandong Hoteam Software PDM Product Data Management System
• Other injection
• SQL injection

Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection

• Totolink WA300
• Other injection
• Command injection

Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection

• Totolink WA300
• Other injection
• Command injection

Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection

• Totolink WA300
• Other injection
• Command injection

code-projects Gym Management System In PHP/Windows NT index.php sql injection

• code-projects Gym Management System In PHP
• code-projects Windows NT
• Other injection
• SQL injection

JD Cloud JDCOS Service jdcap set_iptv_info command injection

• JD Cloud JDCOS
• Other injection
• Command injection

AV Stumpfl Pixera Two Media Server Websocket API code injection

• AV Stumpfl Pixera Two Media Server
• Other injection
• Code injection

Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution

• Other injection

>=1.3.0 · no fixed version yet

Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection

• Dromara MaxKey
• Other injection
• SQL injection

AMTT Hotel Broadband Operation System cardhand_submit.php sql injection

• AMTT Hotel Broadband Operation System
• Other injection
• SQL injection

Dolibarr has an Injection issue

• Other injection
• SQL injection

<=23.0.2 · no fixed version yet

Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection

• Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform
• Other injection
• SQL injection

Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection

• Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System
• Other injection
• SQL injection

Wavlink WL-WN570HA1 adm.cgi ping_ddns command injection

• Wavlink WL-WN570HA1
• Other injection
• Command injection

Wavlink WL-WN570HA1 adm.cgi set_sys_cmd command injection

• Wavlink WL-WN570HA1
• Other injection
• Command injection

Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injection

• Wavlink WL-WN570HA1
• Other injection
• Command injection

langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

• langflow
• Other injection
• Command injection

Edimax BR-6428nC Web setWAN command injection

• Edimax BR-6428nC
• Other injection
• Command injection

Edimax BR-6208AC L2TP Mode setWAN command injection

• Edimax BR-6208AC
• Other injection
• Command injection

YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection

• YunaiV yudao-cloud
• Other injection
• SQL injection

SGLang has an Improper Input Validation/Injection Issue

• Other injection
• Code injection

<=0.5.9 · no fixed version yet

youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection

• youlaitech youlai-boot
• Other injection
• SQL injection

Jinher OA UserSel.aspx sql injection

• Jinher OA
• Other injection
• SQL injection

code-projects Online Hospital Management System viewappointment.php sql injection

• code-projects Online Hospital Management System
• Other injection
• SQL injection

kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection

• kleneway awesome-cursor-mpc-server
• Other injection
• Command injection

crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection

• crazyrabbitLTC mcp-code-review-server
• Other injection
• Command injection