← Back
CWE-644

64 CVEs • Abstraction: Variant • Likelihood of Exploit: High

Improper Neutralization of HTTP Headers for Scripting Syntax

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

JSON object

Loading...

CVEs (64)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-20784
1Voidtools
1Everything
Jun 17, 2026
Jul 14, 2021
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.
CVE-2021-21265
1Octobercms
1October
Jun 17, 2026
Mar 10, 2021
N/A· v4
7.5 HIGH· v3
4.3 MEDIUM· v2
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of t...Show more
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.Show less
CVE-2020-6982
1Honeywell
1Win Pak
Jun 17, 2026
Mar 24, 2020
N/A· v4
8.8 HIGH· v3
5.8 MEDIUM· v2
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
CVE-2017-6031
1Certec Edv Gmbh
1Atvise Scada
May 13, 2026
May 6, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execu...Show more
A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.Show less