Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 8.8 High severity
HummerRisk: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult of the file CloudTaskService.java of the component Cloud Task Dry-run. Performing a manipulation of the argument fileName results in command
- 8.8 High severity
HummerRisk: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in HummerRisk up to 1.5.0. Affected by this issue is some unknown functionality of the file ResourceCreateService.java of the component Cloud Task Scheduler. Such manipulation of the argument regionId leads to command
- 9.8 Critical severity
pearProjectApi: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in
- 9.8 Critical severity
E-Logbook with Health Monitoring System for…: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection.
- 9.8 Critical severity
Event Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out
- 7.1 High severity
valkey: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tamper
- 8.8 High severity
dst-admin: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in qinming99 dst-admin up to 1.5.0. This affects the function revertBackup of the file /home/restore. The manipulation of the argument Name results in command injection. The attack can be launched remotely. The exploit has b
- 9.8 Critical severity
UJCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in inj
- 9.8 Critical severity
Online Reviewer System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/students/assessments/results/studentresult-view.php. The manipulation of the argument test_id results in sql injection. It is poss
- 9.8 Critical severity
Vehicle Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit h
- 9.8 Critical severity
Agri-Trading Online Shopping System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Product results in
- 9.8 Critical severity
dtale: Improper Neutralization of Special Elements in Output Used by a Downstream Component
D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run mal
- 8.3 High severity
ebay-mcp: External Control of System or Configuration Setting
eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows
- 9.8 Critical severity
Simple Responsive Tourism Website: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username cause
- 8.8 High severity
CF-E7: Improper Neutralization of Special Elements used in a Command
A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection.
- 8.8 High severity
CF-E7: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in comm
- 8.8 High severity
JeecgBoot: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads
- 7.3 High severity
Smart Integrated Management Platform System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Controller/XCamera.ashx. This manipulation of the argument ChannelName causes sql injection. Remote exploit
- 7.3 High severity
Smart Integrated Management Platform System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5. This issue affects some unknown processing of the file /Module/CRXT/Controller/XAccessPermissionPlus.ashx. The manipulation of the argument DeviceIDS results i
- 7.5 High severity
Patient Record Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the file /fecalysis_not.php. This manipulation of the argument comp_id causes sql injection. The attack can be initiated remotely. The exploit has
- 9.8 Critical severity
Event Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the a
- 9.8 Critical severity
Event Management System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection
- 9.8 Critical severity
Event Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit
- 9.8 Critical severity
Electronic Archives System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid leads to sql injection. T
- 7.2 High severity
Cart All In One For WooCommerce: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insufficient input validation on the 'Assign page' field which is passed directly to the eval() function. This
- 7.3 High severity
Koyuan Thermoelectricity Heat Network…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0. This affects an unknown part of the file /SISReport/WebReport20/Proxy/AsyncTreeProxy.aspx. The manipulation of the argument PGUID leads to sql inj
- 7.3 High severity
Monitoring and Early Warning System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManage/ProjectRole.aspx. Executing a manipulation of the argument ID can lead to sql injection. It is poss
- 7.2 High severity
WL-NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launc
- 7.2 High severity
CF-E4: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command in
- 8.8 High severity
CF-N1 V2: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be l
- 8.8 High severity
CF-N1 V2: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack c
- 7.3 High severity
Self-service Washing Machine: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Tosei Self-service Washing Machine 4.02. Impacted is an unknown function of the file /cgi-bin/tosei_datasend.php. Executing a manipulation of the argument adr_txt_1 can lead to command injection. It is possible to launch the attack rem
- 8.8 High severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A weakness has been identified in Wavlink WL-WN579A3 up to 20210219. This affects the function AddMac of the file /cgi-bin/wireless.cgi. This manipulation of the argument macAddr causes command injection. The attack is possible to be carried out remotely. The
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list results in command injection. The attack can be executed
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to command injection. Remote exploitation
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched remotely. The exploit ha
- 8.8 High severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The ex
- 7.6 High severity
directorytree/imapengine: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user inpu
- 9.8 Critical severity
assessment-placipy: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
- 7.2 High severity
DCS-931L: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin. Performing a manipulation of the argument AdminID results in command injection. The attack may be initiated remotely. The exploit has been