Browse / Injection and Smuggling

Injection and Smuggling

See it on the mapBypass libraryPayloads

Weaknesses in this class

• CRLF Injection109
• Improper Input Validation76
• HTTP Request Smuggling72
• XML External Entities (XXE)43
• Resource Injection35
• HTTP Response Splitting20
• Improper Handling of URL Encoding (Hex Encoding)5
• LDAP Injection5
• Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)4
• Improper Neutralization of HTTP Headers for Scripting Syntax4
• Improper Neutralization of Escape, Meta, or Control Sequences4
• LLM01: Prompt Injection3
• XML Injection3
• Improper Neutralization of Value Delimiters2
• Improper Neutralization of Formula Elements in a CSV File1
• Improper Output Neutralization for Logs1
• Improper Neutralization of Whitespace1
• File Content Injection1

Often found together with

• Cross-site Scripting52
• Code Execution47

Most upvoted Injection and Smuggling reports

AllValidInformativeN/ADuplicate

1. Bypass for #488147 enables stored XSS on https://paypal.com/signin againHTTP Request Smuggling · high · PayPal
   $20,0002,687 votes
2. Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesHTTP Request Smuggling · critical · Slack
   870 votes
3. Stored XSS on https://paypal.com/signin via cache poisoningHTTP Request Smuggling · high · PayPal
   $18,900685 votes
4. Request smuggling on admin-official.line.me could lead to account takeoverHTTP Request Smuggling · high · LY Corporation
   565 votes
5. Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comHTTP Request Smuggling · critical · Eternal
   559 votes
6. Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`Improper Input Validation · critical · BlockDev Sp. Z o.o
   466 votes
7. CRLF injectionCRLF Injection · medium · X / xAI
   439 votes
8. Bypass of GitLab CI runner slash fix in YAML validationImproper Input Validation · critical · GitLab
   363 votes
9. CRLF Injection in urllibCRLF Injection · medium · Internet Bug Bounty
   $1,000341 votes
10. XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspxXML External Entities (XXE) · critical · Starbucks
    319 votes
11. HTTP Request Smuggling via HTTP/2HTTP Request Smuggling · critical · Basecamp
    $7,500300 votes
12. HTTP request SmugglingHTTP Request Smuggling · high · Helium
    300 votes
13. XXE on sms-be-vip.twitter.com in SXMP ProcessorXML External Entities (XXE) · medium · X / xAI
    258 votes
14. XXE on https://duckduckgo.comXML External Entities (XXE) · critical · DuckDuckGo
    218 votes
15. HTTP Request Smuggling on https://labs.data.govHTTP Request Smuggling · high · GSA Bounty
    $750160 votes
16. LLM01: Invisible Prompt InjectionLLM01: Prompt Injection · medium · HackerOne
    159 votes
17. Partial bypass of #483774 with Blind XXE on https://duckduckgo.comXML External Entities (XXE) · high · DuckDuckGo
    159 votes
18. XXE through injection of a payload in the XMP metadata of a JPEG fileXML External Entities (XXE) · critical · Informatica
    138 votes
19. HTTP Response Header Injection in shopify/pitchfork + Rack 3HTTP Response Splitting · low · Shopify
    $800136 votes
20. HTTP Request Smuggling due to CR-to-Hyphen conversionHTTP Request Smuggling · high · Node.js
    134 votes
21. Improper HTTP header block termination in llhttpHTTP Request Smuggling · medium · Node.js
    122 votes
22. HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionHTTP Request Smuggling · critical · Cloudflare Public Bug Bounty
    $6,000116 votes
23. XXE in Site Audit function exposing file and directory contentsXML External Entities (XXE) · critical · Semrush
    115 votes
24. HTTP request smuggling using malformed Transfer-Encoding headerHTTP Request Smuggling · critical · Node.js
    105 votes
25. Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)Improper Input Validation · low · Mozilla
    98 votes
26. CRLF injection leads to internal XSS on PangleGlobalCRLF Injection · medium · TikTok
    97 votes
27. HTML Injection on tiktoktutorials via firstName parameterImproper Input Validation · low · TikTok
    97 votes
28. XXE in DoD website that may lead to RCEXML External Entities (XXE) · critical · U.S. Dept Of Defense
    97 votes
29. Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMsCRLF Injection · low · X / xAI
    96 votes
30. Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.orgImproper Input Validation · low · Mozilla
    $50093 votes
31. Possibility of Request smuggling attackHTTP Request Smuggling · high · Internet Bug Bounty
    $4,66093 votes
32. moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input ValidationImproper Input Validation · medium · Internet Bug Bounty
    $2,60089 votes
33. Deadlock in x86 HVM standard VGA handlingImproper Input Validation · medium · Internet Bug Bounty
    $2,16288 votes
34. Improper UUID validation results in bypass of #419896Improper Input Validation · high · HackerOne
    82 votes
35. LFI and SSRF via XXE in emblem editorXML External Entities (XXE) · critical · Rockstar Games
    $1,50079 votes
36. Html injection on subscription emailFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) · medium · CS Money
    $30077 votes
37. Pause-based desync in Apache HTTPDHTTP Request Smuggling · high · Internet Bug Bounty
    $4,00074 votes
38. HTTP Smuggling multiple issues in Squid 3.x & squid 4.xHTTP Response Splitting · critical · Internet Bug Bounty
    74 votes
39. HTTP SMUGGLING EXPOSED HMAC/DOS HTTP Request Smuggling · medium · Magic
    74 votes
40. ImageId Format Injection in Image Upload EndpointImproper Input Validation · medium · Lichess
    73 votes
41. Nextcloud Desktop Client RCE via malicious URI schemesResource Injection · medium · Nextcloud
    $1,00073 votes
42. jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofingImproper Input Validation · low · 8x8
    $10072 votes
43. Residual Malicious Payloads on HackerOne after Vulnerability FixesImproper Input Validation · medium · HackerOne
    72 votes
44. Grafana RCE via SMTP server parameter injectionCRLF Injection · critical · Aiven Ltd
    $5,00072 votes
45. Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blogImproper Neutralization of HTTP Headers for Scripting Syntax · low · Shopify
    $1,00067 votes
46. Host Header Injection - internal.qa.delivery.indrive.comCRLF Injection · low · inDrive
    66 votes
47. [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotelyResource Injection · critical · Nintendo
    65 votes
48. Incorrect Deep-link validation leading to unresponsive application and deviceImproper Input Validation · medium · Flickr
    64 votes
49. Security bug https://bugzilla.mozilla.org/oauth/authorize - CRLF Header injection via "redirect_uri" parameterCRLF Injection · low · Mozilla
    $20061 votes
50. HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressResource Injection · low · GitLab
    $1,06061 votes
51. [Source Engine] Material path truncation leads to Remote Code ExecutionImproper Input Validation · high · Valve
    $2,50060 votes
52. HTTP Response Splitting (CRLF injection) in report_storyCRLF Injection · X / xAI
    59 votes
53. CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)HTTP Request Smuggling · high · Internet Bug Bounty
    $4,66057 votes
54. Html injection in event Description Improper Input Validation · low · LinkedIn
    55 votes
55. Content injection in Jira issue title enabling sending arbitrary POST request as victimResource Injection · high · GitLab
    55 votes
56. CVE-2020-8177: curl overwrite local file with -JImproper Input Validation · medium · curl
    55 votes
57. Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`Improper Input Validation · high · BlockDev Sp. Z o.o
    55 votes
58. Arbitrary POST request as victim user from HTML injection in Jupyter notebooksResource Injection · high · GitLab
    54 votes
59. Potential HTTP Request Smuggling in ruby webrickHTTP Request Smuggling · low · Ruby
    53 votes
60. important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)Improper Input Validation · high · Internet Bug Bounty
    $4,92051 votes
61. Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)HTTP Request Smuggling · high · Internet Bug Bounty
    $4,66051 votes
62. HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parserHTTP Request Smuggling · medium · Node.js
    49 votes
63. HTTP request smuggling with Origin Rules using newlines in the host_header action parameterHTTP Request Smuggling · critical · Cloudflare Public Bug Bounty
    $3,10046 votes
64. Http request splittingHTTP Response Splitting · medium · Node.js
    45 votes
65. position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Resource Injection · medium · Nextcloud
    44 votes
66. HTML Injection in Contact Form Email Enables Phishing via Legitimate ████████ InfrastructureImproper Output Neutralization for Logs · medium · Essity
    42 votes
67. xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.XML External Entities (XXE) · Nextcloud
    41 votes
68. Authenticated XXEXML External Entities (XXE) · medium · WordPress
    41 votes
69. Posts sent via websockets aren't sanitized properlyImproper Input Validation · low · Mattermost
    $15040 votes
70. HTTP Request Smuggling HTTP Request Smuggling · high · U.S. Dept Of Defense
    40 votes
71. When you call your branch the same name as a git hash, it could be checked out by dependentsResource Injection · medium · GitLab
    $2,00039 votes
72. XXE on DoD web serverXML External Entities (XXE) · critical · U.S. Dept Of Defense
    38 votes
73. [HTA2] XXE on https://███ via SpellCheck Endpoint.XML External Entities (XXE) · critical · U.S. Dept Of Defense
    37 votes
74. CSS Injection to disable app & potential message exfilImproper Input Validation · medium · Slack
    37 votes
75. [m.airbnb.com] CRLF InjectionHTTP Response Splitting · low · Airbnb
    $2,50037 votes
76. Unquoted body background attribute enables CSS injection that bypasses remote image blockingResource Injection · medium · Nextcloud
    35 votes
77. Smuggling content in PR with refs/replace in GitHubResource Injection · medium · GitHub
    35 votes
78. Improper input validation in projects leads to fully deny access to project resourcesImproper Input Validation · medium · Semrush
    35 votes
79. Potential HTTP Request Smuggling in nodejsHTTP Request Smuggling · low · Node.js
    $25034 votes
80. CRLF injection on www.starbucks.comCRLF Injection · medium · Starbucks
    34 votes
81. Bypass parsing of transaction data, users on the phishing site will transfer/approve ERC20 tokens without being alertedImproper Input Validation · low · MetaMask
    $1,00032 votes
82. Command injection in GitHub Actions ContainerStepHostResource Injection · GitHub
    $4,00032 votes
83. CRLF INJECTION CRLF Injection · low · U.S. General Services Administration
    32 votes
84. Singapore - XXE at https://www.starbucks.com.sg/RestApi/soap11XML External Entities (XXE) · high · Starbucks
    32 votes
85. athome.starbucks.com - URL parameter tampering of review forms permitted possible content injectionImproper Input Validation · medium · Starbucks
    31 votes
86. Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status LineHTTP Request Smuggling · medium · Node.js
    30 votes
87. ZMQ RPC Log Injection and Untrusted Payload PersistenceCRLF Injection · medium · Monero
    30 votes
88. important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)Improper Input Validation · high · Internet Bug Bounty
    $4,92030 votes
89. Add more seats by paying less via PUT /v2/seats request manipulationImproper Input Validation · medium · Krisp
    30 votes
90. HTTP Response Splitting (CRLF injection) due to headers overflowCRLF Injection · X / xAI
    30 votes
91. Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation)Improper Neutralization of Whitespace · medium · Revive Adserver
    28 votes
92. HTTP request smuggling on Basecamp 2 allows web cache poisoningHTTP Request Smuggling · critical · Basecamp
    28 votes
93. CSS injection via BB code tag "█████"Resource Injection · medium · phpBB
    28 votes
94. SMTP Command Injection in Appointment Emails via NewlinesCRLF Injection · medium · Nextcloud
    27 votes
95. Host Header InjectionHTTP Request Smuggling · medium · Kartpay
    27 votes
96. Unauthenticated request smuggling on launchpad.37signals.comHTTP Request Smuggling · critical · Basecamp
    27 votes
97. HTTP parameter pollution from outdated Greenhouse.io JS dependencyResource Injection · medium · Slack
    26 votes
98. Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code ExecutionResource Injection · medium · GitHub
    25 votes
99. Local File Inclusion in download.phpImproper Input Validation · medium · U.S. Dept Of Defense
    25 votes
100. Camo Image Proxy Bypass with CSS Escape SequencesImproper Neutralization of Escape, Meta, or Control Sequences · low · Chaturbate
     25 votes