Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.2 High severity
iTop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter
- 9.8 Critical severity
Interview Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /addCandidate.php. The manipulation of the argument candName results in sql injection. The attack can
- 9.8 Critical severity
Online Admission System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_login.php. The manipulation of the argument keywords leads to sql injection. The attack can be initiate
- 9.8 Critical severity
Baby Care System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcome. Such manipulation of the argument roleid leads to sql injection. The attack can be launched remote
- 9.8 Critical severity
Baby Care System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. This manipulation of the argument msgid causes sql injection. The attack can be initiated remotely. The
- 9.8 Critical severity
Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orders.php. The manipulation of the argument ID results in sql injection. It is possible to launch the at
- 9.8 Critical severity
Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has
- 9.8 Critical severity
Survey Application System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Executing manipulation of the argument fullname can lead to sql injection. The attack may be performed fr
- 9.8 Critical severity
Online Job Search Engine: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument username/phone results in sql injection. The attack is possible to be carried out remot
- 7.2 High severity
DedeBIZ: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_add.php. Such manipulation of the argument flags[] leads to sql injection. The attack can be executed remotely. The explo
- 8.8 High severity
Farm Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exp
- 8.8 High severity
Community Edition: XML Injection
A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads
- 9.8 Critical severity
Operation and Maintenance Security Management…: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. T
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has be
- 9.8 Critical severity
School File Management: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remote
- 7.2 High severity
DedeBIZ: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/spec_add.php. This manipulation of the argument flags[] causes sql injection. The attack is possible to be carried out remotely
- 7.2 High severity
DedeBIZ: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderby results in sql injection. The attack can be executed remotely. The exploit has been made public and
- 7.2 High severity
DedeBIZ: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templets_one_edit.php. The manipulation of the argument ids leads to sql injection. Remote exploitation of the attack is possible. The exploit has been d
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook.php. Such manipulation of the argument rid leads to sql injection. The attack can be launched remotel
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulation of the argument email causes sql injection. The attack can be initiated remotely. The exploit has b
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php. The manipulation of the argument eid results in sql injection. It is possible to launch the attack
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from
- 9.9 Critical severity
Quipux: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/busqueda.php txt_usua_codi, anexos_lista.php radi_temp, Administracion/listas/formArea_ajax.php codDepe, Administracion/l
- 9.8 Critical severity
Billing System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exp
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out
- 9.8 Critical severity
School Fees Payment Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_course. The manipulation of the argument ID results in sql injection. The attack can be e
- 7.2 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exp
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing a manipulation of the argument id/ini_weight results in sql injection. The attack may be i
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be c
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possi
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit ha
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation of the argument loan_id leads to sql injection. The attack may be initiated remotely. The exploit has
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be laun
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the file /admin_class.php. Performing manipulation of the argument Name results in sql injection. The attack
- 7.2 High severity
Simple Online Hotel Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_account.php. The manipulation of the argument Name results in sql injection. The attack may be performed fr
- 7.3 High severity
Ghost Hot Spot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The explo
- 9.8 Critical severity
Retro Basketball Shoes Online Store: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. Remote exploitation
- 9.8 Critical severity
Retro Basketball Shoes Online Store: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.ph. Executing a manipulation of the argument pid can lead to sql injection. The attack may be launched
- 9.8 Critical severity
Retro Basketball Shoes Online Store: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Performing a manipulation of the argument pid results in sql injection. The attack may be initiated rem