Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.3 High severity
Visitor Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It
- 7.3 High severity
Visitor Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotel
- 7.3 High severity
Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_imag
- 7.2 High severity
FortiManager: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer
- 7.2 High severity
FortiManager: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to r
- 7.5 High severity
rails: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize
- 7.3 High severity
Airline Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. T
- 7.4 High severity
BillionMail: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead t
- 7.3 High severity
JeecgBoot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote expl
- 7.3 High severity
OA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack r
- 7.4 High severity
flow-core-x: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation.
- 7.3 High severity
DataEase: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in DataEase up to 2.10.27/3.1.0. Affected is the function ExtWhere2Str.extWhere2sqlOjb of the file engine/trans/ExtWhere2Str.java of the component Chart Data Handler. Such manipulation of the argument operator leads t
- 8.3 High severity
Internet of Agents: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argumen
- 9.0 Critical severity
Cronicle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_
- 7.3 High severity
Online Book Store: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /admin_edit.php. The manipulation of the argument bookisbn with the input 1%27%20AND%20GTID_SUBSET(CONCAT(0x71717a6b71,(SELEC
- 8.3 High severity
DB-GPT: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotel
- 10.0 Critical severity
BR-6208AC: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and m
- 7.3 High severity
Complete Sales and Inventory System with…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attac
- 7.3 High severity
Division Regional Athletic Meet Game Result…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible t
- 7.3 High severity
EmployeeRecruitmentSystem: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/reqformprocessing.php of the component Requirement Board Update Handler
- 7.5 High severity
MQ: Improper Neutralization of Special Elements in Output Used by a Downstream Component
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injec
- 7.3 High severity
funadmin: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be
- 7.3 High severity
School-Management-System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The e
- 8.1 High severity
core: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated priv
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation
- 7.3 High severity
XunRuiCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code i
- 7.3 High severity
XunRuiCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The
- 7.3 High severity
XunRuiCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to laun
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is n
- 10.0 Critical severity
WL-WN530BE1-A: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remo
- 7.3 High severity
cak-filemanagement-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forward
- 8.8 High severity
Formidable Forms – Contact Form, Survey, Quiz…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to i
- 7.2 High severity
OpenCATS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled lic
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments ca
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possib
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name
- 9.9 Critical severity
A950RG: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and
- 9.1 Critical severity
A950RG: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command in