Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Assessment Management: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly availab
- 9.8 Critical severity
Assessment Management: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.php. This manipulation of the argument linked[] causes sql injection. The attack can be initiated remo
- 8.8 High severity
DWR-M920: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be
- 8.8 High severity
DWR-M920: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attac
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/addusers.php. Such manipulation of the argument a leads to sql injection. It is possible to launch the at
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugeesreport.php. This manipulation of the argument a causes sql injection. It is possible to initiate the
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Refugee Food Management System 1.0. Affected is an unknown function of the file /home/refugeesreport2.php. The manipulation of the argument a results in sql injection. The attack may be performed from remote. The e
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This impacts an unknown function of the file /home/viewtakenfd.php. The manipulation of the argument tfid leads to sql injection. The attack is possible to be carri
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown function of the file /home/served.php. Executing manipulation of the argument refNo can lead to sql injection. The attack can be executed remotely. The
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in code-projects Refugee Food Management System 1.0. The impacted element is an unknown function of the file /home/pagenateRefugeesList.php. Performing manipulation of the argument rfid results in sql injection. Remote explo
- 7.2 High severity
Simple PHP CMS: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remot
- 9.8 Critical severity
Student Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /statistical.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicl
- 9.8 Critical severity
Online Cake Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /detailtransac.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The explo
- 9.8 Critical severity
Online Cake Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The expl
- 9.8 Critical severity
Online Cake Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. The impacted element is an unknown function of the file /updatecustomer.php?action=edit. The manipulation of the argument ID leads to sql injection. The attack may be initiated rem
- 7.2 High severity
CmsEasy: Improper Control of Generation of Code
A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code in
- 7.2 High severity
EyouCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.php of the component Backend Template Management. The manipulation of the argument content results in
- 7.3 High severity
phpok3w: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The
- 7.3 High severity
onlinemcqexam: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. This vulnerability affects unknown code of the file /admin/quesadd.php. Performing manipulation of the argument ans1/ans2 results in sql injection. The atta
- 8.8 High severity
TEW-822DRE: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Such manipulation of the argument peerPin leads to command injection. The attack can be executed remotely. The exploit has
- 8.8 High severity
TEW-800MB: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public a
- 8.8 High severity
TEW-800MB: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injectio
- 8.8 High severity
Z4Pro+: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to
- 8.8 High severity
Z4Pro+: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate
- 8.8 High severity
Z4Pro+: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from
- 9.8 Critical severity
Hotels_Server: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown functionality of the file /controller/api/Room.php. Such manipulation of the argument hotelId leads
- 9.8 Critical severity
Student Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manipulation of the argument sy results in sql injection. The attack may be launched remotely. The exploit
- 9.8 Critical severity
Student Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. Th
- 9.8 Critical severity
Student Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely.
- 9.8 Critical severity
Online Frozen Foods Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The explo
- 9.8 Critical severity
Online Frozen Foods Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The e
- 7.3 High severity
Student Information System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Student Information System 1.0. This issue affects some unknown processing of the file /searchresults.php. Executing manipulation of the argument searchbox can lead to sql injection. The attack may be performed from remot
- 9.8 Critical severity
Online Farm System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in code-projects Online Farm System 1.0. Affected is an unknown function of the file /addProduct.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly
- 9.8 Critical severity
WH450: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection. The attack can be l
- 9.8 Critical severity
Student Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been rel
- 9.6 Critical severity
Mynet: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
- 9.8 Critical severity
Refugee Food Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in code-projects Refugee Food Management System 1.0. The affected element is an unknown function of the file /home/home.php. This manipulation of the argument a causes sql injection. The attack is possible to be carried out remot
- 9.8 Critical severity
Simple Stock System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulation of the argument uname results in sql injection. The attack can be executed remotely. The exploit has been made public
- 8.8 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orderby leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly a
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has