Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.2 High severity
Hotel Broadband Operation System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in AMTT Hotel Broadband Operation System 1.0. This affects an unknown part of the file /manager/card/cardmake_down.php. Performing manipulation of the argument ID results in sql injection. It is possible to initiate the atta
- 7.2 High severity
JIZHICMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/deleteAll.html of the component Batch Delete Comments. Executing a manipulation can lead to sql injectio
- 7.2 High severity
JIZHICMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component Add Display Name Field. Performing a manipulation of the argument aid/tid results in sql injection. T
- 7.2 High severity
WebStack-Guns: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/constant/factory/PageFactory.java. Executing a manipulation of the argument sort can lead to sql injecti
- 9.8 Critical severity
NBR1005GPEV2: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The
- 9.8 Critical severity
NBR1005GPEV2: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remo
- 9.8 Critical severity
NBR1005GPEV2: Improper Neutralization of Special Elements used in a Command
A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the argument mac can lead to command injection. The attack may be performed from remote. The exploit has
- 9.8 Critical severity
B-QE2W401: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Performing manipulation of the argument del_swifimac results in command injection. The attack is possible to
- 7.3 High severity
Qualitor: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento/request/getResumo.php. Performing a manipulation of the argument passageiros results in code injecti
- 9.8 Critical severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The explo
- 9.8 Critical severity
WTCMS: Improper Control of Generation of Code
A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack
- 9.8 Critical severity
WTCMS: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminControll
- 9.8 Critical severity
WTCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file application/Admin/Controller/SlideController.class.php of the component SlideController. The manipulation o
- 7.2 High severity
Online Student Clearance System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipulation of the argument txtconfirm_password causes sql injection. It is possible to initiate the attac
- 9.8 Critical severity
COVID Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument code results in sql injection. The attack may be performed from remote. The exploit is n
- 9.8 Critical severity
Question Paper Generator: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack
- 9.8 Critical severity
Jonnys Liquor: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injectio
- 8.8 High severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule_edit1.php. Such manipulation of the argument schedule_id leads to sql injection. The attack may be l
- 8.8 High severity
Library System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed
- 8.8 High severity
Library System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and cou
- 9.8 Critical severity
Library System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The expl
- 8.8 High severity
Blog Site: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php of the component Category Handler. Such manipulation of the argument name/field leads to sql injection
- 9.8 Critical severity
Advanced Library Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipulation of the argument admin_id leads to sql injection. Remote exploitation of the attack is possible.
- 8.8 High severity
Simple Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched re
- 8.8 High severity
COVID Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=state. Performing manipulation of the argument ID results in sql injection. The attack may be initiated rem
- 8.8 High severity
COVID Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/?page=city. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disc
- 8.8 High severity
COVID Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published a
- 8.8 High severity
COVID Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exp
- 9.8 Critical severity
DIR-852: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in D-Link DIR-852 1.00. This issue affects some unknown processing of the file /gena.cgi. Such manipulation of the argument service leads to command injection. The attack can be executed remotely. The exploit is publicly availabl
- 9.8 Critical severity
Company Website CMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.php. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The
- 9.8 Critical severity
Company Website CMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been
- 9.8 Critical severity
Online Polling System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /registeracc.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The e
- 9.8 Critical severity
Online Polling System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Executing a manipulation of the argument myusername can lead to sql injection. The attack can be launche
- 9.8 Critical severity
School File Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument stud_no results in sql injection. The attack can be initiated
- 9.8 Critical severity
Supplier Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the component Login. Such manipulation of the argument txtUsername leads to sql injection. It is possible to laun
- 9.8 Critical severity
travel-agency: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality of the file /results.php of the component Search. The manipulation of the argument user_query result
- 7.2 High severity
travel-agency: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an unknown functionality of the file /admin_area/index.php. The manipulation of the argument edit_pack le
- 9.8 Critical severity
Online File Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=login. The manipulation of the argument Username results in sql injection. The attack may be launched
- 9.8 Critical severity
dataease: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname sche
- 9.8 Critical severity
Online Shop Project: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The ex