Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.3 High severity
FilePress: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/admin.php of the component Shares Filelist API. Such manipulation of the argument order leads to sql
- 7.3 High severity
Leave Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipulation of the argument txt_username causes sql injection. The attack can be initiated remotely. The exploit has been mad
- 7.3 High severity
SUP Online Shopping: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.php. The manipulation of the argument msgid results in sql injection. It is possible to launch the attack remotely. The
- 7.3 High severity
SUP Online Shopping: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. The manipulation of the argument seenid leads to sql injection. It is possible to initiate the attack remotely. The explo
- 7.3 High severity
SUP Online Shopping: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file wishlist.php. Executing a manipulation of the argument delwlistid can lead to sql injection. The attack may be performed from remo
- 7.3 High severity
SUP Online Shopping: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a manipulation of the argument msgid results in sql injection. The attack is possible to be carried out
- 7.3 High severity
Comment System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_comment.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has bee
- 7.5 High severity
Microsoft 365 Copilot's Business Chat: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- 7.3 High severity
Feedback System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the file /admin/checklogin.php. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. Th
- 9.1 Critical severity
i18next-http-backend: Improper Limitation of a Pathname to a Restricted Directory
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the conf
- 7.3 High severity
Pharmacy Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_user. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exp
- 7.2 High severity
ipTIME C200: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component ApplyRestore Endpoint. This manipulation of the argument RestoreFile causes command injection. The a
- 7.3 High severity
code-mcp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src/code_mcp/server.py of the component MCP Tool. Performing a manipulation of the argument operation re
- 7.3 High severity
PDM Product Data Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder caus
- 7.3 High severity
Pixera Two Media Server: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation causes code injection. The attack can be initiated remotely. The exploit has been published and may be
- 7.3 High severity
EEMS Enterprise Power Operation and…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. The manipulation of the argument fCircuitids leads t
- 7.3 High severity
ECEMS Enterprise Microgrid Energy Efficiency…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0. The impacted element is an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. Executing a manipulation of the argument fCircuiti
- 9.8 Critical severity
WL-WN570HA1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. This issue affects the function set_sys_adm of the file /cgi-bin/adm.cgi. This manipulation of the argument Username causes command injection. It is possible to initiate the attack remo
- 7.3 High severity
OA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of the argument DeptIDList causes sql injection. The attack is possible to be carried out remotely. The
- 7.3 High severity
Online Hospital Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out rem
- 7.3 High severity
Courier Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /edit_staff.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit
- 7.3 High severity
Electronic Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is pu
- 7.3 High severity
Pharmacy Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=save_customer. The manipulation of the argument ID leads to sql injection. It is possible to initiate the att
- 7.3 High severity
Pharmacy Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_customer. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed f
- 8.8 High severity
NR1800X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried
- 7.3 High severity
Advanced School Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitati
- 7.3 High severity
Hotel Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts an unknown function of the file /index.php/reservation/check. Such manipulation of the argument room_type leads to sql injection. The attack may be launched remotely. Th
- 7.3 High severity
EyouCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The
- 7.3 High severity
aider-mcp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of the file aider_mcp.py of the component code_with_ai. The manipulation of the argument working_dir/editable_files leads
- 7.3 High severity
Pizzafy Ecommerce System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=get_cart_count. This manipulation of the argument ID causes sql injection. The attack is possible to be
- 7.3 High severity
Pizzafy Ecommerce System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file /admin/ajax.php?action=login. The manipulation of the argument e-mail results in sql injection. The attack can be executed remotely. The exp
- 7.3 High severity
Pizzafy Ecommerce System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?action=login2. The manipulation of the argument e-mail leads to sql injection. Remote exploitation of
- 7.3 High severity
Pizzafy Ecommerce System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete_menu of the file /admin/ajax.php?action=delete_menu. Executing a manipulation of the argument ID can lead to sql injection. The attack
- 7.3 High severity
Pizzafy Ecommerce System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /admin/ajax.php?action=delete_cart. Performing a manipulation of the argument ID results in sql injection. The attack may be i
- 7.3 High severity
gmx-vmd-mcp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_server.py of the component VMD Launch Handler. The manipulation of the argument structure_file/trajectory_file results in
- 7.3 High severity
MCP: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of the file mcp_server.py of the component Git Search API. Executing a manipulation of the argument repo_url/pattern can lead to command inject
- 7.3 High severity
sqlite-mcp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/entry.py. Performing a manipulation of the argument output_filename results in sql injection. Remote exploitation of the
- 7.3 High severity
Pharmacy Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injectio
- 7.3 High severity
Pharmacy Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_product. This manipulation of the argument ID causes sql injection. The attack is possible to be carrie
- 8.8 High severity
HG3: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The