Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.2 High severity
ChanCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. This affects the function hasUse of the file /cms/model/hasUse. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed
- 7.2 High severity
ChanCMS: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing a manipulation of the argument cid can lead to sql injection. The attack can be launched remotely. The exploit h
- 7.2 High severity
ChanCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField. Performing a manipulation of the argument cid results in sql injection. The attack can be initiated r
- 9.8 Critical severity
Online Examination System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. T
- 7.2 High severity
Automated Voting System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_user.php. This manipulation of the argument Password causes sql injection. The attack is possible to be
- 8.8 High severity
Automated Voting System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candidate_modal.php.. The manipulation of the argument firstname results in sql injection. The attack can
- 9.8 Critical severity
Online Beauty Parlor Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /admin/search-appointment.php. Such manipulation of the argument searchdata leads to sql injection. The
- 9.8 Critical severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulation of the argument serv_id results in sql injection. It is possible to launch the attack remotely. T
- 7.3 High severity
Inferno Online Clothing Store: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208. The affected element is an unknown function of the file /log.php. Such manipulation of the argument cemail/password leads to sql injection
- 9.8 Critical severity
DocSys: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to
- 9.8 Critical severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the atta
- 9.8 Critical severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit-appointment.php. Such manipulation of the argument editid leads to sql injection. The attack may be
- 8.8 High severity
Simple Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of the argument cname results in sql injection. The attack can be launched remotely. The exploit has been
- 8.8 High severity
Simple Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit h
- 8.8 High severity
Simple Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out remotely. The exploit h
- 8.8 High severity
Simple Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manipulation of the argument editBrandName results in sql injection. The attack can be executed remotely.
- 9.8 Critical severity
E-Banking System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component POST Parameter Handler. The manipulation of the argument username/password leads to sql injection. It
- 8.8 High severity
Client Details System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipulation of the argument uid leads to sql injection. The attack can be executed remotely. The exploit is
- 9.8 Critical severity
Online Ordering Food System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possibl
- 8.8 High severity
Simple Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulation of the argument Category results in sql injection. The attack may be launched remotely. The explo
- 9.8 Critical severity
Online Student Result System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack can be ini
- 8.8 High severity
Simple Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such manipulation of the argument cname leads to sql injection. It is possible to launch the attack remot
- 9.8 Critical severity
Online Apartment Visitor Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php. This manipulation of the argument email causes sql injection. It is possible to initiate the attack r
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in code-projects E-Commerce Website 1.0. The impacted element is an unknown function of the file /pages/product_add_qty.php. The manipulation of the argument prod_id leads to sql injection. The attack is possible to be carried ou
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php. Executing manipulation of the argument order_id can lead to sql injection. The attack can be execut
- 9.8 Critical severity
Online Apartment Visitor Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /admin-profile.php. Performing a manipulation of the argument mobilenumber results in sql injection. Remote exploitation of the a
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now p
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/actions/delete-member.php. The manipulation of the argument ID leads to sql injection. The attack can be
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/equipment-entry.php. Executing a manipulation of the argument ename can lead to sql injection. It is possible t
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a manipulation of the argument plan results in sql injection. It is possible to initiate the attack remo
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in CodeAstro Gym Management System 1.0. This impacts an unknown function of the file /customer/index.php. Such manipulation of the argument fullname leads to sql injection. The attack may be performed from remote. The exploit is
- 9.8 Critical severity
Project Monitoring System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /useredit.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely. The exploit has
- 9.8 Critical severity
Online Job Search Engine: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Online Job Search Engine 1.0. The affected element is an unknown function of the file /searchjob.php. The manipulation of the argument txtspecialization leads to sql injection. Remote exploitation of the attack i
- 9.8 Critical severity
Online Job Search Engine: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in code-projects Online Job Search Engine 1.0. Impacted is an unknown function of the file /postjob.php. Executing manipulation of the argument txtjobID can lead to sql injection. The attack may be launched remotely. The exploit has been
- 9.8 Critical severity
Online Job Search Engine: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in code-projects Online Job Search Engine 1.0. This issue affects some unknown processing of the file /registration.php. Performing manipulation of the argument txtusername results in sql injection. The attack may be initiated remo
- 8.1 High severity
pyload: Improper Neutralization of Special Elements in Output Used by a Downstream Component
pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This flaw allowed un
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack is possible to be carried out remot
- 9.8 Critical severity
Gate Pass Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such manipulation of the argument fullname leads to sql injection. The attack can be executed remotely. The e
- 9.8 Critical severity
Simple Leave Manager: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argument table causes sql injection. Remote exploitation of the attack is possible. The exploit has been pu