Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Retro Basketball Shoes Online Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_index.php. Such manipulation of the argument Username leads to sql injection. The attack can be l
- 7.5 High severity
RUET OJ: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This vulnerability affects unknown code of the file /process.php of the component POST Request Handler. The manipulation of the argument un results in sql injection.
- 9.8 Critical severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exp
- 9.8 Critical severity
Courier Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The manipulation of the argument OfficeName leads to sql injection. The attack is possible to be carried out
- 9.8 Critical severity
Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulation of the argument itemPrice can lead to sql injection. The attack can be executed remotely. The explo
- 9.8 Critical severity
Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitation of the attack is
- 9.8 Critical severity
DI-7001 MINI: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The explo
- 9.8 Critical severity
Nero Social Networking Site: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The
- 9.8 Critical severity
Nero Social Networking Site: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql injection. It is possib
- 9.8 Critical severity
Nero Social Networking Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed fro
- 9.8 Critical severity
Nero Social Networking Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The ex
- 9.8 Critical severity
Point of Sales: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit h
- 9.8 Critical severity
Point of Sales: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The expl
- 9.8 Critical severity
Point of Sales: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit ha
- 7.2 High severity
Wholesale Inventory Control and Inventory…: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown function of the file /Admin_dashboard/edit_profile. Such manipulation of the argument first_name/last_name
- 7.3 High severity
Online-School: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible to be
- 8.8 High severity
Online Event Judging System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is
- 8.8 High severity
Online Event Judging System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely.
- 9.8 Critical severity
Online Student Result System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be car
- 8.8 High severity
Online Event Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Executing manipulation of the argument contestant_id can lead to sql injection. The attack can be execute
- 8.8 High severity
Online Event Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing manipulation of the argument fullname results in sql injection. Remote exploitation of the attack is
- 8.8 High severity
Online Event Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.php. Such manipulation of the argument fullname leads to sql injection. The attack may be launched remo
- 9.8 Critical severity
Hotel Broadband Operation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be
- 8.8 High severity
Online Event Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of the argument content results in sql injection. The attack can be launched remotely. The exploit has be
- 7.3 High severity
CLTPHP: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the argument keyword leads to sql injection. The attack may be performed from remote. The exploit has been
- 8.8 High severity
Client Details System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql i
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. The attack can be la
- 8.8 High severity
Automated Voting System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be c
- 9.8 Critical severity
Advanced Library Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulation of the argument keywords leads to sql injection. The attack can be executed remotely. The exploit
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. Remote exploitation of the attack
- 9.8 Critical severity
Online Shopping System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried
- 8.8 High severity
Mediawiki - LanguageSelector Extension: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension:
- 7.2 High severity
Vvveb: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exp
- 8.8 High severity
Streamax Crocus: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This manipulation of the argument orderField causes sql injection. The attack can be initiated remotely. The e
- 8.8 High severity
Streamax Crocus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. It is possible to launch the atta
- 8.8 High severity
Streamax Crocus: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection. It is possible to in
- 8.8 High severity
Streamax Crocus: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead to sql injection. The
- 8.8 High severity
ChanCMS: Improper Control of Generation of Code
A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack may be launched remotely. The exploit has