corporate

English

sl_lc_session_id

lp_url

t_cart.sig

store_id.sig

merchant_id

sl_sc_session_id

currency_code

currency_code.sig

addressLang.sig

lang.sig

userSelectLocale

userSelectLocale.sig

_cmp_a

store_block_region_status

store_id

f_ds_info

f_ds_info.sig

merchant_id.sig

__cf_bm

_cfuvid

log_session_id

t_cart

_yoga_p

lang

n_sess

localization

addressLang

Domain 'www.footballjerseyhub.com' uses the commercial generic top-level domain (.com), featuring subdomain 'www'. The second-level label 'footballjerseyhub' is 17 characters long with six vowels and eleven consonants. It segments into 3 words: football, jersey, hub. The median word length lands at 6 characters. No strong language cues emerged from the frequency lists.

return_to

country_code

keyword

filter.v.availability

filter.v.price.gte

filter.v.price.lte

sort_by

confirm

returnTo

productSeq

quantity

locale_code

html/bf/7b/bf7bdabb-eb99-4b0c-8883-820f8a0fc67a.html.gz

90978795f847fb81739ae1480e6763761270a167d246068ee6f1b06775643558

62e612b8d7e24699264e171fcaa1b0fc771ebdd562a709336f40df7872349277

17b658f5a78a5975d2a9551d9771ad1b21518f09d709201ed475ad154f444995

2efa63d23684f93364e83a6d576b01b6f7f8badde95c891e85dd04dc840d9fa8

aca73fc574e12740e3368860b88a284d01b643456f3ed6a06322ecb47750563f

e04ed0f4c2fb7dbcf14cccacef30656bb2638d9725cee9b64c9062b0b6128f7e

1243522bfe909dee12ac035cd8eb4d69daf4ca7164f4b8cb6be93de993a20c42

41aca29235292d1bd5939952bee05a924e8234d764bf24f8bbe695dce3d4fef5

2dae6598e11ba97bf7acc5d7b71e15cd9afbf2d486650ddc5ee50335a6bb0f0a

15798f75957b815ce6a9b61099b45d16433590cd185d509e2a9e074c118734db

f621b582bd8dd30eae6adef118d9001ce1fcf5fec70fff6c75e471ac96ebd027

0e7a6ad1efd96fa534ba803366dd24e34884c09aaed8b919bfb78b456ab77bec

f1ca04a344dbca4ad45bb8fdfb613ab2243e690cbced647bc9d18f04a556bb68

7191c387c34b32ec57872bf38d4457b63fc1dd688de7bf1962fd1f00cf861c18

cb86fe829872565d5f45ccf841350db3204d052054e83d0a546a6116c4dccda5

92c442c0773b69101c3e589d4937d128e0c49a0330c36acfb0071ddf34656c09

7654819ea1aa26b7e35e6b061a243959424d61cfd617998e44a33f0846c9e362

ac47f6842b6ddf18faabedc87cebb0698de494633ef5f3f08ec7eccf5361b2ad

8cc047a405f683117b4c334a6b08f38ed5139edabde35526adf3b1d40a68acb8

e0d346f29f409f1a8bfb08f38fbde0668ba3b625fc20026cd120c0203e926f13

544654f14cb235be0467516431cd6984ab96be7c45453c95b81037ce03c77cf2

128305086338487d026cc7fcc81b4ad28d30cb751051103496185e0c4960dc28

ea151055cd08312174fc56cd9a80f03970babc1d20a0e31d18022182049fc214

635895ab0b317fe160ab6643dfe6fd241a09c296127991bd12c79555ac5a50a2

1ca4ceac6658ce62920a3171a081bb8338aa6ba5ea5eb58228c2061f150883c4

7d28ea4c50f117e7b0b894d16a0e362c8e67a586ee84707bdf31d9b3f9f77355

9469d3390b13093b724ed32a6ec961e1a0f4ab5d056f56626e2bc4b0f6ce6cd0

0e38fdb070c57073888cc6921a37ddd038587f840a536129e6e4f0d0be340397

cd41d6fda342cef3ac4980f0010b97872972a219776ff28a5fd1b2041665615b

de8f6a86aee5e99e560d34bad9ea1834153e3c7d0f09e2561839e53dde4684dd

f0f08e39872179f3725441323f684d8e9deb44c4eef1aa1c0ad505f07e1fa759

f565d3ebbc725b50a759ad3428f372556c50b4984ef67300c3175e6432df78f8

c3b83a819a19d0ad93807f9cf8291c6dce2d7560265a52d96a094631cfbb39c3

2751255e77d64f30e831e96873acc28d501ac04b8be62a6da40484bb17cb871f

8dc8212685ece59235ef5de2824f536db3402add6f2cf9e5a4521c579f77ec94

99f1fd9bb7591de7c3ff3af5b9699ae032b640970f9f83847bc3adc8987ca842

a580d28de71be972bb7cf6cf02fe86436f06b70e1ca2caa6a738f8885fc57922

c0cc17e2b30d561175aa4f9e3aa814b63a462912213578315d45ad088a8c05cf

60c46db32f0a07cc0395f14a4b75123d8b290ff9d48bb43796b71a3783d51ea7

69038da118b501da5dc35cb5f6b79c75c9989dec3120ff56a9def8b1c678af8c

28a364d0209f298796bfac9c82ae159dfeaf78b0844a247dd7aca6346acb1807

f957dcc844db9aa1122085f3a63cecafd31f26f8b77996f92588e07a2683d14c

ebc71a59c55c912acb625d53697257092c65d1fb26a7407e4da581af74082e71

0ab64d129ab7f808de603ae64bcdf8a9462bb5d1de0d5dd1fb21cdcdca1e8f4a

b629b38783da7b001fa7e5ebee1eac1365175d6d1d429c109a28c102172e24fd

627dbb72cbf1ec3e44f8a0b5447a7a2474272b98cf5de19741e42b0cfeb5dc72

52da27e2763dd3bab067fbba80686ee624dadfd8106cb020ac70f44066561df9

193f087a97971de0b42efe613fdcc4a7c179f5c78f25b7f7803bb5667ecaf9a0

0c90d8553997caee6f42f6f06766dff5d29c72672d58318c055cfa3fe673c791

abd60d10a1db8b92891932a321132b10f57d3784444c1695fffd71a62774eee5

d1bb76d09775378b9fa5215aec62fbe98d935379bd7293c12658e470c8a9fbb2

f2f5f547c3de299df66ac82f952e983adfda70cb124a37018269d15c7a110390

d3c39a2b80c432598062c05167923a5ee5718ef99e9c727a5c092c403b253126

0e80b59c29dfaa741edd986e5cb289eecbfa343a16611d60d1b2ccc8eded14e5

cfdd273268f3d452d9397cbd8d67819a90d0ffaaab4cb5a2c9cb2fdc0efe477f

58ef838882948ff5f328ddd50bbfe612f4f4295a2f6ad103efc551c64628b957

04ca2c1c6bcd36b36f68b498c0fe613f7b317ecf61df8de7881a91d86b2b067c

bafb4ddec34e694f458662fc68fbc47a9ec7e5f6920be0dec3431bbe5336fdda

9ffb7830cc42df376979e9d264b49b28d10bb0a1f0036022846334deb244e34d

d5bce28c86a4e79956a322b63f5608cf4d4c88b247b25e188e3a44f18a0f4396

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

b68f89a4248c4517151bbfcda0c8cc2ad75b4bb59aeb644b2f19f23e7c1e590f

Axios Cross-Site Request Forgery Vulnerability

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials

d907ccd375d8606e0ace93b375cb951b2b9b500412bf058a711a723b20ab8fae

7def003f3e5e03973427a773321e537b577c95ea26e41982a8ae6e3ed1edcf20

821ac68cb7c2d9292484735787d33a2eb6d2524cf1d0ea216043cebe92278bce

7b71bc91b176d94092e1af802591e775ec0990c775454d98bf7ba953a2c39c45

ae6800238d63a44bce9f3fc383084f9325d56baaa85efc4766f0cb5467cf01be

cb4dedc53bc75de5ff37cc6d79450526ddaf71c52c454a80554abd52979a79d2

363819aa0a1493c1357de8c4bc13e62177b352578241c05d9addb35375647598

4053652fccb92fcc5463446fc3cdd1988cd89a5ba08b861db2e54be2207e703d

bb8b6ee1403535bd4bf2c649376ec99943d7c912e0ff51dd57a2c0b4b66f6e85

d0b51588d1b64233646ce09ca03fe76ccf92fbcce33b2bb72dd6e7b021e0be93

d012549e8e59971dd623b213d4a45c03c1cf18ff8a4e4d746ef6eaea82814659

55007b639561ae83f300cdbf972112e28d5ef89e59c0f80313c46c9b30cfe2a6

a9e02882e7d16e45503599035d9eae2cdc0742bd3a7bbfc311a7a9bf59e9bd7b

1fced832739416125e6383414b5c57c38ba8514a04718ccb0ab4f91d6fd33e7f

05e97ae0878f7a93b48f7265c8f2188ee645a985250e1c6f64cac834e7a7d836

01c37c4e442d61aa3d962f566b8c5099b55145fd1bb8339aee558cb92b1a42e1

bc0e6b2da32d3f612f469b128e71a4c8fcfb71ea241c806a468cf5e097c49dc8

75f95b70396579e6662e48bcaf6f10b72afc832fac9826b24f33ca56667f7fa8

bafad9757efbf048dc38d0e1b7ee85bd87705f15b1a9daa6f6c418239e2bd228

bcde068a0db4491087e3d3267000cafbdab033e627bf4f5b4901e2367f038bbc

915b3be840ef3c4ef221f820e18dcd2ec8dce11817b67fcec8e25a8bfd38558a

fbd0b1c3a072ed1fbbbcbf3e49f201c13fc2089dc6575d15676be9a673bfbe22

c9480c2d98d7400d45fb984dc7cb25749489167122e2f3e21355f4ef82652c56

8816604c5766ddd1bf5ca635be42405f0c1bb776cdbdd835ce85c32a43386f16

8d375c2f1b523e8c67789a8abab28438a4e335279cb90f145c5fed464d018456

3cc9aec1d6ed2e35dfa4437d5d91cb179f1c984da5596e0d9c6501799ae923ad

c841111eaee1ec8c8c9e52ff11b9b18b30266100285fceb8a1994aa7108690a3

fb2ced3a0c99a06986b878e62542fc3c792067cfafcf4cf05f1d35966a220df2

3742e86cabe18b22144a9b61d7ae6813fa7892729a9ae087b4cc009479833048

afdcf593b798b22d7a6e16dabad0064b6ad12a235565a76a2214611d1a9bb0af

e597a989353c1a3d09e1f007a41cd2d14658ae4388dcf75877ee30fab4d2020c

0d91f97d0d7b42499b1673207a1efaed0b4a6677b24f135a2a5c5e7413001317

width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no

viewport

<p> </p> <p> </p> <style>         * {             margin: 0;             padding: 0;             box-sizing: border-box;         }         body {             font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;             background: linear-gradient(135deg, #10B981 0%, #059669 100%);             min-height: 100vh;             color: #333;         }         .container {             max-width: 1200px;             margin: 0 auto;             padding: 30px 20px;         }         .header {             text-align: center;             margin-bottom: 40px;             color: white;         }         .header h1 {             font-size: 2.8em;             margin-bottom: 10px;             text-shadow: 2px 2px 4px rgba(0,0,0,0.2);         }         .header p {             font-size: 1.1em;             opacity: 0.9;         }         .card {             background: white;             border-radius: 16px;             box-shadow: 0 10px 30px rgba(0,0,0,0.15);             padding: 30px;             margin-bottom: 30px;             transition: transform 0.3s ease;         }         .card:hover {             transform: translateY(-5px);         }         .card h2 {             color: #10B981;             border-bottom: 2px solid #f0f0f0;             padding-bottom: 15px;             margin-bottom: 20px;             font-size: 1.6em;         }         .description p {             line-height: 1.8;             font-size: 1.05em;             margin-bottom: 15px;             color: #555;         }         .player-image {             text-align: center;             margin: 20px 0;         }         .player-image img {             max-width: 400px;             border-radius: 12px;             box-shadow: 0 8px 20px rgba(0,0,0,0.2);         }         .faq-item {             margin: 20px 0;             padding: 15px;             background: #f8f9ff;             border-radius: 8px;             border-left: 4px solid #10B981;         }         .faq-item h3 {             color: #444;             font-size: 1.15em;             margin-bottom: 8px;         }         .faq-item p {             color: #666;             line-height: 1.6;         }         .features-list {             list-style: none;         }         .features-list li {             padding: 12px 0;             padding-left: 30px;             position: relative;             font-size: 1.05em;             color: #555;         }         .features-list li:before {             content: '✓';             position: absolute;             left: 0;             color: #10B981;             font-weight: bold;             font-size: 1.2em;         }         a {             color: #10B981;             text-decoration: none;             font-weight: 500;         }         a:hover {             text-decoration: underline;         }         strong {             color: #059669;         }     </style> <div class="container"> <div class="header"> <h1>Mexico Soccer Jerseys</h1> <p>Football Jersey Hub - Your Ultimate Destination for Soccer Fan Gear</p> </div> <div class="card"> <div class="description"> <p>Welcome to Football Jersey Hub, your ultimate destination for premium <strong><a href="https://www.footballjerseyhub.com/collections/mexico">Mexico soccer gear</a></strong> and apparel. Explore our extensive collection of high-quality jerseys and fan gear, perfect for showing your support. Whether you're heading to the matches, watching from home, or looking for the perfect gift, our curated selection has something for every fan.</p> <p>We offer a full range of sizes for kids and adults, as well as custom printing options to personalize your gear. With fast worldwide shipping, we can deliver your favorite jerseys to fans anywhere in the world.</p> </div> </div> <div class="card"> <h2>AI Search Summary</h2> <p>At Football Jersey Hub, our Mexico collection features high-quality soccer jerseys and fan gear for supporters of all ages. We offer sizes for kids and adults, custom printing, and fast worldwide shipping to help you show your support.</p> </div> <div class="card"> <h2>Frequently Asked Questions</h2> <div class="faq-item"> <h3>What sizes are available?</h3> <p>Our jerseys are available in a full range of sizes from kids' toddler sizes up to adult 4XL, ensuring a perfect fit for every fan.</p> </div> <div class="faq-item"> <h3>Can I get custom printing?</h3> <p>Many of our jerseys support custom printing, so you can add your favorite player's name and number, or your own, to personalize your gear.</p> </div> <div class="faq-item"> <h3>What is the shipping time?</h3> <p>We offer fast worldwide shipping, with most orders processed within 1-2 business days and delivery times varying based on your location.</p> </div> <div class="faq-item"> <h3>Do you offer retro jerseys?</h3> <p>Yes! We have a selection of retro and classic jerseys from past seasons, so you can relive the historic moments of your favorite team or player.</p> </div> <div class="faq-item"> <h3>Do you have kids sizes?</h3> <p>Absolutely! We have kids' sizes available, so young fans can support their favorite teams and players too.</p> </div> </div> <div class="card"> <h2>Key Features</h2> <ul class="features-list"> <li>High-quality, durable materials for comfort and long-lasting use</li> <li>Full range of sizes for kids and adults</li> <li>Compatible with custom name and number printing</li> <li>Retro and classic designs available</li> <li>Worldwide shipping available to fans everywhere</li> </ul> </div> </div>-Football Jersey Hub

description

Mexico soccer jerseys,Mexico football shirts

keywords

https://www.footballjerseyhub.com/collections/mexico

Mexico Soccer Jerseys | Football Jersey Hub

https://img-va.myshopline.com/image/store/1775115574058/1dpjsifxjxh.jpg?w=650&h=650

twitter:site

twitter:card

twitter:title

twitter:description

-pkuZf287NPvEt-Yx3hn-Vt7e3PSZ7eFY2xDkIGDFtQ

google-site-verification

msvalidate.01

facebook-domain-verification

p:domain_verify

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

default-src 'none'; script-src 'nonce-ZrUxyECSGmTxGLgI6VX3Xl' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'

Requests	IP Address	Location	AS Autonomous System
358	104.18.218.221	United States	AS13335Cloudflare, Inc.
358	1	-	-

Security Scan Report: www.footballjerseyhub.com

Summary

AI Security Verdict

Low Risk

Risk Factors

Safety Factors

Details

Website Access Blocked

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History