Threats Tagged 'cwe-93'

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.

HTTPX2 versions prior to 2.11.0 improperly serialize per-file Content-Type and custom headers in multipart/form-data requests without validating for CRLF characters. This allows an attacker controlling upload metadata to inject additional multipart part headers by including CR or LF characters in header values, potentially altering multipart semantics or bypassing server-side checks. The vulnerability is fixed in HTTPX2 2.11.0, which rejects forbidden control characters in multipart headers.

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.

A CRLF injection vulnerability exists in Laravel framework versions prior to 12.60.0 and 13.10.0. This vulnerability affects email validation combined with Symfony Mailer and Mime handling, potentially allowing unauthenticated attackers to interfere with outbound email processing when sending mail to user-supplied addresses. The issue has been patched in versions 12.60.0 and 13.10.0.

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

CVE-2026-71573 is a vulnerability in Joomla! CMS involving improper CORS origin validation in versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. This flaw allows certain CORS requests to bypass origin checks due to improper implementation. The issue is classified as CWE-93, related to improper neutralization of CRLF sequences. The vulnerability has a CVSS 4.0 base score of 6.9, indicating high severity.

CVE-2026-71572 is a medium severity vulnerability in Joomla! CMS affecting versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It involves improper neutralization of CRLF sequences leading to response header injection in download views. This flaw allows reflected file download or content-type confusion due to lack of output processing in multiple download views.

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.