CWE-644 · weakness in Injection and Smuggling
Improper Neutralization of HTTP Headers for Scripting Syntax
61 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 61 is a mark on the map. Named now: 1 to 26, most at risk first.
- A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been iden…
- October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
- HTTP Host Header Injection in Request Handling in Typo3
- HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website…
- In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
- IBM CICS TX information disclosure
- Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
- IBM Tivoli Application Dependency Discovery Manager HOST header injection
- Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access…
- Header Injection in SAP Solution Manager (Diagnostic Agent)
- OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation
- JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax
- jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax
- All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol…
- Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulner…
- Forwarded header exploit with Spring HATEOAS on WebFlux
- Stored XSS via MMS3 patch metadata (admin context)
N-able4 articles4 articles this week: Attackers Probe N-able N-central Zero-Days After Disclosure
- Consul L7 Intentions Vulnerable To Headers Bypass
- @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
- A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default mi…
- IBM API Connect HOST header injection
- Coolify has host header injection in forgot password
- picocms Pico - Host Header Injection Enables Script Source Hijacking
- IBM TXSeries for Multiplatforms information disclosure
- A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing t…
- MediaCrush Header paths.py http headers for scripting syntax
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.