Browse / Injection and Smuggling

Injection and Smuggling

See it on the mapBypass libraryPayloads

Weaknesses in this class

• CRLF Injection109
• Improper Input Validation76
• HTTP Request Smuggling72
• XML External Entities (XXE)43
• Resource Injection35
• HTTP Response Splitting20
• Improper Handling of URL Encoding (Hex Encoding)5
• LDAP Injection5
• Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)4
• Improper Neutralization of HTTP Headers for Scripting Syntax4
• Improper Neutralization of Escape, Meta, or Control Sequences4
• LLM01: Prompt Injection3
• XML Injection3
• Improper Neutralization of Value Delimiters2
• Improper Neutralization of Formula Elements in a CSV File1
• Improper Output Neutralization for Logs1
• Improper Neutralization of Whitespace1
• File Content Injection1

Often found together with

• Cross-site Scripting52
• Code Execution47

Most upvoted Injection and Smuggling reports

AllValidInformativeN/ADuplicate

1. Host header injection leads to account takeoverDuplicateImproper Neutralization of HTTP Headers for Scripting Syntax · high · Enjin
   47 votes
2. http request smuggling in twitter.comDuplicateHTTP Request Smuggling · high · X / xAI
   17 votes
3. SMTP CRLF Command Injection in CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPTDuplicateCRLF Injection · medium · curl
   11 votes
4. HTTP Host Header Injection on app.goodhire.comDuplicateHTTP Response Splitting · Inflection
   5 votes
5. Host Header Injection and Cache PoisoningDuplicateCRLF Injection · Inflection
   4 votes
6. CRLF Injection in developer.uber.comDuplicateCRLF Injection · Uber
   3 votes
7. Host Header Injection allow HiJack Password Reset LinkDuplicateCRLF Injection · low · Concrete CMS
   1 votes