Browse / Injection and Smuggling

Injection and Smuggling

See it on the mapBypass libraryPayloads

Weaknesses in this class

• CRLF Injection109
• Improper Input Validation76
• HTTP Request Smuggling72
• XML External Entities (XXE)43
• Resource Injection35
• HTTP Response Splitting20
• Improper Handling of URL Encoding (Hex Encoding)5
• LDAP Injection5
• Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)4
• Improper Neutralization of HTTP Headers for Scripting Syntax4
• Improper Neutralization of Escape, Meta, or Control Sequences4
• LLM01: Prompt Injection3
• XML Injection3
• Improper Neutralization of Value Delimiters2
• Improper Neutralization of Formula Elements in a CSV File1
• Improper Output Neutralization for Logs1
• Improper Neutralization of Whitespace1
• File Content Injection1

Often found together with

• Cross-site Scripting52
• Code Execution47

Most upvoted Injection and Smuggling reports

AllValidInformativeN/ADuplicate

1. Prompt Injection via GitHub Patch in Brave AI Chat (Leo)InformativeLLM01: Prompt Injection · high · Brave Software
   77 votes
2. #**CSV Injection in shared passwords leads to complete Private Vault Exfiltration**InformativeImproper Neutralization of Formula Elements in a CSV File · 1Password - Enterprise Password Manager
   75 votes
3. LLM03: Training Data Poisoning via ASCII decoding InformativeLLM01: Prompt Injection · HackerOne
   61 votes
4. MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstateInformativeImproper Input Validation · medium · curl
   36 votes
5. HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECTInformativeHTTP Request Smuggling · low · curl
   30 votes
6. HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabledInformativeHTTP Request Smuggling · medium · curl
   26 votes
7. HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoningInformativeImproper Input Validation · high · curl
   26 votes
8. Unescaped username in SASL DIGEST-MD5 response allows injectionInformativeImproper Neutralization of Escape, Meta, or Control Sequences · low · curl
   26 votes
9. HTTP/3 Protocol Smuggling and Header Injection via CRLF in QPACK value conversionInformativeCRLF Injection · critical · curl
   24 votes
10. YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.comInformativeResource Injection · low · Cloudflare Public Bug Bounty
    24 votes
11. Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotesInformativeImproper Input Validation · low · curl
    20 votes
12. libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injectionInformativeCRLF Injection · low · curl
    18 votes
13. Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connectionsInformativeHTTP Request Smuggling · medium · curl
    18 votes
14. Cookie attribute TAB injection regression in Set-Cookie parsingInformativeImproper Input Validation · low · curl
    18 votes
15. libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP requestInformativeImproper Input Validation · low · curl
    16 votes
16. HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)InformativeHTTP Request Smuggling · medium · curl
    16 votes
17. IMAP Protocol Desynchronization and Response Smuggling via Naive Literal ParsingInformativeImproper Input Validation · low · curl
    14 votes
18. HTTP Request SmugglingInformativeHTTP Request Smuggling · high · Brave Software
    12 votes
19. Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespaceInformativeImproper Handling of URL Encoding (Hex Encoding) · medium · curl
    11 votes
20. HTTP Request SmugglingInformativeHTTP Request Smuggling · medium · JamieWeb
    10 votes
21. 'net/http': HTTP Header Injection in the set_content_type methodInformativeCRLF Injection · high · Ruby
    9 votes
22. Digest Authentication Header InjectionInformativeHTTP Response Splitting · low · curl
    8 votes
23. HTTP Host injection in redirect_to functionInformativeImproper Neutralization of HTTP Headers for Scripting Syntax · Ruby on Rails
    6 votes
24. RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of eInformativeCRLF Injection · low · curl
    5 votes
25. SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)InformativeCRLF Injection · low · curl
    5 votes
26. Header CRLF Injection in Ruby Net::HTTPInformativeCRLF Injection · Ruby
    5 votes
27. HTTP Header Injection/HTTP_Response_SplittingInformativeHTTP Request Smuggling · Blockchain
    4 votes
28. Add arbitrary value in reset password cookieInformativeCRLF Injection · medium · Legal Robot
    3 votes
29. [iOS] URI Obfuscation in iOS applicationInformativeHTTP Response Splitting · low · Brave Software
    3 votes
30. XXE in OAuth2 Applications gallery profile App logoInformativeXML External Entities (XXE) · Coinbase
    3 votes
31. CRLF Injection in legacy url API (url.parse().hostname)InformativeCRLF Injection · medium · Node.js
    2 votes
32. Division by zero if terminal width is 2InformativeImproper Input Validation · curl
    1 votes
33. Gratipay Website CSP "script-scr" includes "unsafe-inline"InformativeHTTP Request Smuggling · low · Gratipay
    1 votes
34. curl still vulnerable to SMB access smuggling via FILE URL on WindowsInformativeImproper Input Validation · curl
35. Incorrect IPv6 literal parsing leads to validated connection to unexpected https server.InformativeImproper Handling of URL Encoding (Hex Encoding) · medium · curl