Improper Neutralization
CWE-707
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being used when received from an upstream component, or before being sent to a downstream component.
We track 97 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 2 have been exploited in real attacks.
Latest Improper Neutralization vulnerabilities
- 7.4 High severity
BillionMail: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead t
- 8.8 High severity
Splunk SOAR: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T
- 9.9 Critical severity
Splunk Enterprise: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T
- 9.8 Critical severity
Splunk Enterprise: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T
- 9.8 Critical severity
Cisco Application Policy Infrastructure…: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening r
- 8.8 High severity
Cisco NX-OS Software: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di
- 7.3 High severity
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1.
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such man
- 9.9 Critical severity
Cisco Secure Firewall Adaptive Security…: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond
- 9.8 Critical severity
Cisco Secure Email: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software har
- 8.8 High severity
Cisco IOS XR Software: Improper Neutralization
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple inte
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. T
- 8.6 High severity
WSO2 Universal Gateway: Improper Neutralization
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a
- 7.3 High severity
JeeWMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a m
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploi
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_tool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The
- 7.3 High severity
KLiK SocialMediaWebsite: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in KLiK SocialMediaWebsite 1.0. This issue affects some unknown processing of the component HTTP POST Request Parameter Handler. Such manipulation leads to injection. The attack can be launched remotely. The exploit is publicly a
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has be
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT_PATTERNS
- 7.3 High severity
localGPT: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The impacted element is the function _route_using_overviews of the file backend/server.py of the component LLM Prompt Handler. Such manipulation leads to i
- 9.8 Critical severity
JFlow: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe. Affected by this vulnerability is the function Calculate of the file src/main/java/bp/wf/httphandler/WF_CCForm.java. Such manipulation leads to injection. The attack
- 9.8 Critical severity
UJCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in inj
- 7.0 High severity
Microsoft Windows Management Console (MMC) Improper Neutralization Exploited
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
- 9.8 Critical severity
DNS-320: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argum
- 9.8 Critical severity
DNS-320: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation o
- 9.8 Critical severity
Bookstore Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initi
- 9.8 Critical severity
Bookstore Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search.php. The manipulation of the argument s leads to sql injection. It is possible to initiate the attack
- 8.0 High severity
WEB-Sekolah: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses_Kirim.php of the component Mail Handler. The manipulation of the argument Name leads to sql injectio
- 7.5 High severity
E-Health Care System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app_request.php. The manipulation of the argument app_id leads to sql injection. It is possible to launc
- 7.5 High severity
E-Health Care System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/chat.php. The manipulation of the argument name/message leads to sql injection. The attack may be ini
- 7.5 High severity
E-Health Care System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/req_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiat
- 8.8 High severity
University Event Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects University Event Management System 1.0. It has been classified as critical. This affects an unknown part of the file doedit.php. The manipulation of the argument id leads to sql injection. It is possible to initiate t
- 9.8 Critical severity
Hospital Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of the file /doctorAction.php. The manipulation of the argument Name leads to sql injection. The attack ma
- 9.8 Critical severity
Pet Shop Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /productsadd.php. The manipulation of the argument id/name leads to sql injection. It is possible to initiate the
- 9.8 Critical severity
University Event Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects University Event Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file submit.php. The manipulation of the argument name/email/title/Year/gender/fromdate/todate/p
- 7.8 High severity
Microsoft Windows Management Console Remote Code Execution Exploited
Microsoft Management Console Remote Code Execution Vulnerability
- 8.8 High severity
InControl: Improper Control of Generation of Code
A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the argument fields
- 7.8 High severity
Intel(R) Arc(TM) & Iris(R) Xe Graphics software: Improper Neutralization of Invalid Characters in Identifiers in Web Pages
Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.
- 7.8 High severity
Intel(R) Power Gadget software for macOS: Improper Neutralization
Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Power Gadget software for Windows: Improper Neutralization
Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- 9.8 Critical severity
Sanitization Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql inje