Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.3 High severity
mcp-bridge-api: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/ar
- 8.6 High severity
kakoune: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05
- 7.3 High severity
Simple Doctors Appointment System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack
- 7.3 High severity
Photo Share Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is pos
- 7.3 High severity
Photo Share Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. Th
- 7.3 High severity
house: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated rem
- 7.3 High severity
Computer Repair Shop Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql in
- 7.3 High severity
Visual Integrated Command and Dispatch Platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It
- 8.1 High severity
nuxt: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template executio
- 7.3 High severity
Student-Management-System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the compone
- 9.8 Critical severity
Cisco IOS XE Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of
- 7.3 High severity
CDG: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit
- 7.3 High severity
PDM Product Data Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads t
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The ve
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The explo
- 8.8 High severity
AX1800: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The att
- 7.3 High severity
VibeSurf: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation o
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initia
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. Th
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection.
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can le
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. T
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The a
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to com
- 7.3 High severity
GitPython: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the
- 9.8 Critical severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injecti
- 8.8 High severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch le
- 8.0 High severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command inj
- 8.8 High severity
GL-MT3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in co
- 8.7 High severity
hashi-vault-js: Relative Path Traversal
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of usin
- 9.9 Critical severity
logging-operator: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records va
- 8.3 High severity
swagger-typescript-api: Improper Neutralization of Special Elements in Output Used by a Downstream Component
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/pr
- 8.3 High severity
swagger-typescript-api: Improper Neutralization of Special Elements in Output Used by a Downstream Component
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping
- 8.3 High severity
swagger-typescript-api: Improper Neutralization of Special Elements in Output Used by a Downstream Component
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpola
- 8.3 High severity
swagger-typescript-api: Improper Neutralization of Special Elements in Output Used by a Downstream Component
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without