Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Online Doctor Appointment System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Online Doctor Appointment System 1.0. This impacts an unknown function of the file /admin/patient_action.php. Such manipulation of the argument patient_id leads to sql injection. The attack may be launched remotel
- 7.3 High severity
wms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the component Basic Organizational Structure Module. Performing a manipulation of the argument Name results in
- 9.8 Critical severity
University Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /att_add.php. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit ha
- 7.3 High severity
ACG1000-AK230: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit
- 9.1 Critical severity
budibase: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path p
- 9.8 Critical severity
Easy7 CMS Windows: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. This manipulation of the argument strTBName causes sql injection. The attack may be initiated remotely. The exploit has
- 9.8 Critical severity
JFlow: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe. Affected by this vulnerability is the function Calculate of the file src/main/java/bp/wf/httphandler/WF_CCForm.java. Such manipulation leads to injection. The attack
- 8.8 High severity
Resort Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The e
- 7.2 High severity
CF-AC100: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the component GET Parameter Handler. This manipulation of the argument sellid causes sql injection. It is
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file purchase_invoice.php of the component GET Parameter Handler. The manipulation of the argument purchaseid results in sql injection. The attack m
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php of the component Search. The manipulation of the argument searchtxt leads to sql injection. The atta
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file check_supplier_details.php of the component POST Parameter Handler. Executing a manipulation of the argument stock_na
- 8.8 High severity
EasyCMS: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order results in sql injection. The attack
- 8.8 High severity
EasyCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order leads to sql injection. The attack can be
- 8.8 High severity
Resort Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. Such manipulation of the argument q leads to sql injection. The attack may be performed from remote. T
- 8.8 High severity
sanitize or validate this input: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode sanitize or validate this input 1.0. Affected is an unknown function of the file /admin/teacher-attendance.php. Executing a manipulation of the argument teacher_id can lead to sql injection. The attack may be laun
- 9.8 Critical severity
University Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode University Management System 1.0. This affects an unknown function of the file /att_single_view.php. Such manipulation of the argument dt leads to sql injection. The attack can be launched remotely. The exploit is
- 9.8 Critical severity
University Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /view_result.php. Performing a manipulation of the argument seme results in sql injection. The attack is possible to be carried o
- 9.8 Critical severity
Online Art Gallery Shop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in projectworlds Online Art Gallery Shop 1.0. This affects an unknown part of the file /admin/adminHome.php. Such manipulation of the argument reach_nm leads to sql injection. The attack can be executed remotely. The
- 9.8 Critical severity
Online Art Gallery Shop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in projectworlds Online Art Gallery Shop 1.0. Affected by this issue is some unknown functionality of the file /admin/adminHome.php. This manipulation of the argument Info causes sql injection. Remote exploitation of the attack i
- 9.8 Critical severity
Online Art Gallery Shop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in projectworlds Online Art Gallery Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /?pass=1. The manipulation of the argument fnm results in sql injection. The attack may be launched remotel
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in SourceCodester Sales and Inventory System up to 1.0. Affected is an unknown function of the file /check_item_details.php. The manipulation of the argument stock_name1 leads to sql injection. The attack may be initiated remotel
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /check_customer_details.php of the component POST Handler. Executing a manipulation of the argument stock_name1 can lead to sql inject
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /add_stock.php. Performing a manipulation of the argument cost results in sql injection. The attack can be initiated remotely. The exploit
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Sales and Inventory System up to 1.0. The impacted element is an unknown function of the file /add_sales_print.php. Such manipulation of the argument sid leads to sql injection. It is possible to launch the atta
- 7.2 High severity
Employee Task Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Employee Task Management System up to 1.0. The affected element is an unknown function of the file /daily-task-report.php of the component GET Parameter Handler. This manipulation of the argument Date causes sql injectio
- 7.2 High severity
Employee Task Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of the component GET Parameter Handler. The manipulation of the argument Date results in sql injection.
- 9.8 Critical severity
University Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /add_result.php. Such manipulation of the argument subject leads to sql injection. The attack may be launched remo
- 9.8 Critical severity
Simple Responsive Tourism Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username
- 8.8 High severity
Student Web Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument User results in sql injection. The attack can be launched remotely. The exploit has been made public an
- 9.8 Critical severity
Student Web Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Student Web Portal 1.0. This impacts the function valreg_passwdation of the file signup.php. The manipulation of the argument reg_passwd leads to sql injection. The attack can be initiated remotely. The exploit h
- 9.8 Critical severity
University Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_search_student.php. This manipulation of the argument admin_search_student causes sql injection. The attack is possible to be ca
- 9.8 Critical severity
Simple Flight Ticket Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. Affected by this issue is some unknown functionality of the file SearchResultRoundtrip.php. Performing a manipulation of the argument from results in sql injection. The attack
- 9.8 Critical severity
Simple Flight Ticket Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file SearchResultOneway.php. Such manipulation of the argument from leads to sql injection. The attack ca
- 9.8 Critical severity
Free Hotel Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /hotel/admin/mod_amenities/index.php?view=edit. Performing a manipulation of the argument amen_id/rmtype_id results i
- 9.8 Critical severity
Simple Flight Ticket Booking System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. The manipulation of the argument flightno results in sql injection. The attack may be performed from re
- 7.2 High severity
Simple Flight Ticket Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in code-projects Simple Flight Ticket Booking System 1.0. Affected is an unknown function of the file /Adminupdate.php. The manipulation of the argument flightno/airplaneid/departure/dtime/arrival/atime/ec/ep/bc/bp results in sql i
- 7.2 High severity
Simple Flight Ticket Booking System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in code-projects Simple Flight Ticket Booking System 1.0. This impacts an unknown function of the file /Adminadd.php. The manipulation of the argument flightno/airplaneid/departure/dtime/arrival/atime/ec/ep/bc/bp lead
- 9.8 Critical severity
Simple Flight Ticket Booking System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /register.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be launched remotel