CWE-117 · Injection and Smuggling
Improper Output Neutralization for Logs
140CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
140 CVEs with CWE-117 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-32549log injection in Sling loggingApache Software Foundation · Apache Sling · 2022-06-22 | – | 2.5% | 2022-06-22 |
| CVE-2021-43410airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statementsApache Software Foundation · Apache Airavata Django Portal · 2021-12-09 | – | 2.5% | 2021-12-09 |
| CVE-2019-14864Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callb…Red Hat · Ansible · CVSS 5.7 · 2020-01-02 | 5.7 | 1.9% | 2020-01-02 |
| CVE-2021-42250Possible log injectionApache Software Foundation · Apache Superset · 2021-11-17 | – | 1.8% | 2021-11-17 |
| CVE-2024-47083Power Platform Terraform Provider has Improper Masking of Secrets in Logsmicrosoft · terraform-provider-power-platform · CVSS 8.8 · 2024-09-25 | 8.8 | 1.6% | 2024-09-25 |
| CVE-2020-36567Arbitrary log line injection in github.com/gin-gonic/gingithub.com/gin-gonic/gin · github.com/gin-gonic/gin · CVSS 7.5 · 2022-12-27 | 7.5 | 1.5% | 2022-12-27 |
| CVE-2025-54813Apache Log4cxx: Improper escaping with JSONLayoutApache Software Foundation · Apache Log4cxx · CVSS 6.3 · 2025-08-22 | 6.3 | 1.5% | 2025-08-22 |
| CVE-2025-54812Apache Log4cxx: Improper HTML escaping in HTMLLayoutApache Software Foundation · Apache Log4cxx · CVSS 2.1 · 2025-08-22 | 2.1 | 1.4% | 2025-08-22 |
| CVE-2020-25646A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentialityAnsible Community · Community Collections · CVSS 7.5 · 2020-10-29 | 7.5 | 1.4% | 2020-10-29 |
| CVE-2021-22096In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additio…Vmware · Spring Framework · 2021-10-28 | – | 1.4% | 2021-10-28 |
| CVE-2023-39461Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write VulnerabilityTriangle MicroWorks · SCADA Data Gateway · CVSS 4.4 · 2024-05-03 | 4.4 | 1.3% | 2024-05-03 |
| CVE-2021-20333Server log entry spoofing via newline injectionMongoDB Inc. · MongoDB Server · CVSS 5.3 · 2021-07-23 | 5.3 | 1.3% | 2021-07-23 |
| CVE-2022-4011Simple History Plugin Header neutralization for logsSimple History Project · Simple History Plugin · CVSS 6.5 · 2022-11-16 | 6.5 | 1.3% | 2022-11-16 |
| CVE-2020-4072Log Forging in generator-jhipster-kotlinjhipster · jhipster-kotlin · CVSS 5.3 · 2020-06-25 | 5.3 | 1.2% | 2020-06-25 |
| CVE-2020-11644GateManager Audit Message Spoofing VulnerabilityB&R · GateManager · CVSS 6.5 · 2020-10-15 | 6.5 | 1.2% | 2020-10-15 |
| CVE-2018-10932lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control…Intel · lldptool · CVSS 4.3 · 2018-08-21 | 4.3 | 1.0% | 2018-08-21 |
| CVE-2023-6484Keycloak: log injection during webauthn authentication or registrationRed Hat · Red Hat build of Keycloak 22 · CVSS 5.3 · 2024-04-25 | 5.3 | 1.0% | 2024-04-25 |
| CVE-2019-10213OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privi…Red Hat · openshift · CVSS 5.3 · 2019-11-25 | 5.3 | 1.0% | 2019-11-25 |
| CVE-2015-10011OpenDNS OpenResolve endpoints.py neutralization for logsOpenDNS · OpenResolve · CVSS 4.6 · 2023-01-02 | 4.6 | 0.9% | 2023-01-02 |
| CVE-2022-3941Activity Log Plugin HTTP Header neutralization for logsActivity Log Project · Activity Log Plugin · CVSS 5.3 · 2022-11-11 | 5.3 | 0.9% | 2022-11-11 |
| CVE-2026-17481IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionIBM · Documentation Offline · CVSS 8.8 · 2026-08-13 | 8.8 | 0.9% | 2026-08-13 |
| CVE-2024-0987Sichuan Yougou Technology KuERP log neutralization for logsSichuan Yougou Technology · KuERP · CVSS 6.3 · 2024-01-29 | 6.3 | 0.9% | 2024-01-29 |
| CVE-2023-46322iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other charact…Iterm2 · Iterm2 · 2023-10-22 | – | 0.8% | 2023-10-22 |
| CVE-2023-46321iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.Iterm2 · Iterm2 · 2023-10-22 | – | 0.8% | 2023-10-22 |
| CVE-2025-48432An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote atta…djangoproject · Django · CVSS 4 · 2025-06-05 | 4.0 | 0.8% | 2025-06-05 |
| CVE-2022-22151CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM V…Yokogawa Electric Corporation · CENTUM CS 3000 · 2022-03-11 | – | 0.8% | 2022-03-11 |
| CVE-2019-14854OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user cou…Red Hat · library-go · CVSS 5.3 · 2020-01-07 | 5.3 | 0.8% | 2020-01-07 |
| CVE-2024-9606Improper Output Neutralization for Logs in berriai/litellmberriai · berriai/litellm · CVSS 7.5 · 2025-03-20 | 7.5 | 0.8% | 2025-03-20 |
| CVE-2026-84501Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProviderApache Software Foundation · Apache ZooKeeper · CVSS 5.3 · 2026-09-16 | 5.3 | 0.7% | 2026-09-16 |
| CVE-2026-84439Apache ZooKeeper: Audit log injection via unsanitized output from multiple sourcesApache Software Foundation · Apache ZooKeeper · CVSS 5.3 · 2026-09-16 | 5.3 | 0.7% | 2026-09-16 |
| CVE-2026-86522Log injection via an unescaped password reset identity in AshAuthenticationteam-alembic · ash_authentication · CVSS 6.3 · 2026-09-17 | 6.3 | 0.7% | 2026-09-17 |
| CVE-2025-54656Apache Struts Extras: Improper Output Neutralization for LogsApache Software Foundation · Apache Struts Extras · CVSS 6.5 · 2025-07-30 | 6.5 | 0.7% | 2025-07-30 |
| CVE-2024-25047IBM Cognos Analytics log injectionIBM · Cognos Analytics · CVSS 8.6 · 2024-05-02 | 8.6 | 0.6% | 2024-05-02 |
| CVE-2022-1522Cognex 3D-A1000 Dimensioning System Improper Output Neutralization for LogsCognex · 3D-A1000 Dimensioning System · CVSS 5.3 · 2022-09-06 | 5.3 | 0.6% | 2022-09-06 |
| CVE-2024-1681Log Injection Vulnerability in corydolphin/flask-corscorydolphin · corydolphin/flask-cors · CVSS 5.3 · 2024-04-19 | 5.3 | 0.6% | 2024-04-19 |
| CVE-2021-23266Improper Output Neutralization for Logs in Crafter StudioCrafter Software · Crafter CMS · CVSS 4.3 · 2022-05-16 | 4.3 | 0.6% | 2022-05-16 |
| CVE-2026-12616The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements be…Eclipse Foundation · Eclipse CSI - PIA · CVSS 6.9 · 2026-06-29 | 6.9 | 0.5% | 2026-06-29 |
| CVE-2024-22356IBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosureIBM · App Connect Enterprise · CVSS 4.9 · 2024-03-26 | 4.9 | 0.5% | 2024-03-26 |
| CVE-2024-0095CVEnvidia · NVIDIA Triton Inference Server · CVSS 4.3 · 2024-06-13 | 4.3 | 0.5% | 2024-06-13 |
| CVE-2026-111211Potential log injection via unescaped geometry form valuesdjangoproject · Django · CVSS 5.3 · 2026-11-03 | 5.3 | 0.5% | 2026-11-03 |
| CVE-2024-8297kitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logskitsada8621 · Digital Library Management System · CVSS 5.3 · 2024-08-29 | 5.3 | 0.5% | 2024-08-29 |
| CVE-2026-93421Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpointmesop-dev · mesop · CVSS 5.3 · 2026-09-23 | 5.3 | 0.5% | 2026-09-23 |
| CVE-2024-52962An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below, version 7.0.13 and b…Fortinet · FortiAnalyzer · CVSS 5 · 2025-04-08 | 5.0 | 0.5% | 2025-04-08 |
| CVE-2019-14846In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of cre…Red Hat · Ansible · CVSS 7.3 · 2019-10-08 | 7.3 | 0.5% | 2019-10-08 |
| CVE-2024-12580Logs Debug Injection in danny-avila/librechatdanny-avila · danny-avila/librechat · CVSS 4.3 · 2025-03-20 | 4.3 | 0.5% | 2025-03-20 |
| CVE-2026-44256Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Usernamewazuh · wazuh · CVSS 5.3 · 2026-08-19 | 5.3 | 0.5% | 2026-08-19 |
| CVE-2023-6002Log InjectionYugabyteDB · YugabyteDB · CVSS 6.5 · 2023-11-07 | 6.5 | 0.5% | 2023-11-07 |
| CVE-2024-8334master-nan Sweet-CMS log.go LogHandler neutralization for logsmaster-nan · Sweet-CMS · CVSS 4.3 · 2024-08-30 | 4.3 | 0.5% | 2024-08-30 |
| CVE-2023-46713An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs v…Fortinet · FortiWeb · CVSS 4.9 · 2023-12-13 | 4.9 | 0.5% | 2023-12-13 |
| CVE-2023-36924Log Injection vulnerability in SAP ERP Defense Forces and Public SecuritySAP_SE · SAP ERP Defense Forces and Public Security · CVSS 4.9 · 2023-07-11 | 4.9 | 0.5% | 2023-07-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.