Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Dental Clinic Appointment Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Dental Clinic Appointment Reservation System 1.0. Impacted is an unknown function of the file /success.php. Performing manipulation of the argument username/password results in sql injection. The attack can be ini
- 8.8 High severity
Online Magazine Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /view_magazine.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The
- 8.8 High severity
Online Magazine Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Online Magazine Management System 1.0. Affected by this issue is some unknown functionality of the file /categories.php. The manipulation of the argument c leads to sql injection. The attack is possible to be ca
- 8.8 High severity
Supplier Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /manufacturer/edit_product.php. Such manipulation of the argument cmbProductUnit leads to sql injection. The attack may be launched remotel
- 8.8 High severity
Supplier Management System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /manufacturer/edit_unit.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been p
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /admin/user/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be i
- 8.8 High severity
Advanced Library Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to sql injection. It is possible to launch the attack
- 8.8 High severity
Advanced Library Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_search.php. Performing a manipulation of the argument book_pub/book_title results in sql injection. It is
- 8.8 High severity
Advanced Library Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /add_member.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be performed from
- 8.8 High severity
Advanced Library Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /add_librarian.php. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remot
- 8.8 High severity
datax-web: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in WeiYe-Jing datax-web up to 2.1.2. Affected is an unknown function. Executing manipulation can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
- 9.8 Critical severity
Patients Waiting Area Queue Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is an unknown function of the file /php/api_patient_schedule.php. This manipulation of the argument appointmentID causes sql injection. The
- 9.8 Critical severity
Tourism Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /admin/user-bookings.php. The manipulation of the argument uid results in sql injection. It is possible to launch the attac
- 8.8 High severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Student Information System 2.0. Impacted is an unknown function of the file /editprofile.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been made public and co
- 9.8 Critical severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Student Information System 2.0. This issue affects some unknown processing of the file /register.php. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has be
- 9.8 Critical severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in code-projects Student Information System 2.0. This vulnerability affects unknown code of the file /index.php. Executing manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit h
- 9.8 Critical severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in code-projects Student Information System 2.0. This affects an unknown part of the file /searchquery.php. Performing manipulation of the argument s results in sql injection. Remote exploitation of the attack is possible. The expl
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Affected is an unknown function of the file /LogSignModal.PHP. The manipulation of the argument U_USERNAME results in sql injection. The attack can be launched remotely. The e
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely.
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in itsourcecode Inventory Management System 1.0. This affects an unknown function of the file /admin/login.php. Executing manipulation of the argument user_email can lead to sql injection. It is possible to launch the attack remo
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Inventory Management System 1.0. The impacted element is an unknown function of the file /index.php?q=product. Performing manipulation of the argument PROID results in sql injection. It is possible to initiate the atta
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /index.php?q=single-item. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remo
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=add. Such manipulation of the argument PROMODEL leads to sql injection. The attack may be pe
- 9.8 Critical severity
Simple Cafe Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in code-projects Simple Cafe Ordering System 1.0. This vulnerability affects unknown code of the file /addmem.php. Executing manipulation of the argument studentnum can lead to sql injection. It is possible to launch the attack r
- 9.8 Critical severity
Simple Cafe Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from re
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely.
- 8.8 High severity
ZZCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and mig
- 9.8 Critical severity
Simple Online Hotel Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/edit_account.php. Performing a manipulation of the argument admin_id results in sql injection. The attack is
- 9.8 Critical severity
Simple Online Hotel Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /add_query_reserve.php. Such manipulation of the argument room_id leads to sql injection. The attack can
- 9.8 Critical severity
ury: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possi
- 9.8 Critical severity
Hotel Broadband Operation System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Executing manipulation of the argument uid can lead to sql injection. It is possible to launch the attac
- 9.8 Critical severity
Patients Waiting Area Queue Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of the file /php/api_patient_checkin.php. Performing manipulation of the argument appointmentID results
- 7.3 High severity
Liketea: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in cameasy Liketea 1.0.0. Impacted is the function list of the file laravel/app/Http/Controllers/Front/StoreController.php of the component API Endpoint. Such manipulation of the argument lng/lat leads to sql injectio
- 9.8 Critical severity
Zoom Workplace for Android: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing manipulation of the argument usname can lead to sql injection. The attack can be executed remotely. The
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing manipulation of the argument eid results in sql injection. Remote exploitation of the attack is possible.
- 9.8 Critical severity
Survey Application System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exp
- 9.8 Critical severity
Alumni Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible.
- 8.1 High severity
OpenAM: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice
- 9.8 Critical severity
School Fees Payment Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely.