CWE-117
CVEs classified under CWE-117, newest first.
42 CVEsRSS
CVE-2026-5078Medium· 5.3morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
GHSA-7856-g3gv-9wq8Lownetfoil: Attacker controlled data written to logs
netfoil: Attacker controlled data written to logs
GHSA-7cx2-g3h9-382pHigh· 8.1Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
CVE-2026-42507Medium· 5.3Arbitrary inputs are included in errors without any escaping in net/textproto
Arbitrary inputs are included in errors without any escaping in net/textproto
CVE-2026-24308High· 7.5⚖ disputedImproper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values ar…
CVE-2025-11537Medium· 5.0Keycloak logs sensitive headers
Keycloak logs sensitive headers
CVE-2026-1337Medium· 5.4PoCInsufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j prod…
CVE-2025-20384Medium· 5.3PoCIn Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (…
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (…
CVE-2025-11627Medium· 6.5PoCThe Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47
The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to in…
CVE-2025-36081Medium· 5.3IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.
IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.
CVE-2025-58580Medium· 6.5An API endpoint allows arbitrary log entries to be created via POST request
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
CVE-2023-6484Medium· 5.3A log injection flaw was found in Keycloak
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.