Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Simple Scheduling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argument faculty results in sql injection. The attack can be executed remotely. The exploit has been made p
- 9.8 Critical severity
Simple Scheduling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the file /addtime.php. The manipulation of the argument starttime/endtime leads to sql injection. Remote exploitation of the a
- 8.8 High severity
Online Leave Application: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence[] can lead to sql injection. The attack may be laun
- 8.8 High severity
Online Leave Application: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. The exploit is now pub
- 9.8 Critical severity
Advanced Online Voting Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidates_edit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely.
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/school_year.php. The manipulation of the argument school_year results in sql injection. It is possible to lau
- 9.8 Critical severity
Computer Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/us_edit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate
- 9.8 Critical severity
Simple Scheduling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in code-projects Simple Scheduling System 1.0. Impacted is an unknown function of the file /schedulingsystem/addroom.php. Executing manipulation of the argument room can lead to sql injection. The attack may be performed from rem
- 9.8 Critical severity
Simple Scheduling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Scheduling System 1.0. This issue affects some unknown processing of the file /schedulingsystem/addcourse.php. Performing manipulation of the argument corcode results in sql injection. The attack is possible to
- 9.8 Critical severity
Simple Scheduling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulingsystem/addfaculty.php. Such manipulation of the argument falname leads to sql injection. The attack can be executed rem
- 9.8 Critical severity
Simple Scheduling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulation of the argument subcode causes sql injection. Remote exploitation of the attack is possible. The e
- 8.8 High severity
Electricity Billing System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The manipulation of the argument uid results in sql injection. The attack may be launched remotely. The
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be launched remotely.
- 9.8 Critical severity
Open Source Job Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php?view=edit. Performing manipulation of the argument ID results in sql injection. The attack can be in
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available a
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely.
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploi
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has b
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possi
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_product_details.php. Such manipulation of the argument prod_id leads to sql injection. The attack may be launched remotely
- 8.8 High severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The expl
- 8.8 High severity
Open Source Job Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected is an unknown function of the file /admin/employee/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The ex
- 9.8 Critical severity
CourseSelectionSystem: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Profilers/PriProfile/COUNT3s4.php. Executing manipulation of the argument cbranch can lead to sql injec
- 8.8 High severity
Open Source Job Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in itsourcecode Open Source Job Portal 1.0. Impacted is an unknown function of the file /admin/vacancy/index.php?view=edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible.
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/add_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be executed remotely.
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_teacher.php. Performing manipulation of the argument department results in sql injection. Remote exploitation of the attack i
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Online Learning Management System 1.0. This affects an unknown function of the file /admin/de_activate.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploi
- 9.8 Critical severity
Project Monitoring System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument username/password causes sql injection. The attack may be initiated remotely. The exploi
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The at
- 9.8 Critical severity
Online Shopping System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publi
- 9.8 Critical severity
Online Bidding System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/bidlist.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Impacted is an unknown function of the file /admin/teachers.php. The manipulation of the argument department results in sql injection. It is possible to launch the attack r
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /admin/edit_department.php. The manipulation of the argument d leads to sql injection. It is possible to initiate the atta
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/save_student.php. Executing manipulation of the argument class_id can lead to sql injection. The attack may be perform
- 9.8 Critical severity
Online Learning Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/edit_student.php. Performing manipulation of the argument cys results in sql injection. The attack is possible to be carried out remot
- 9.8 Critical severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/print_inv.php. Such manipulation of the argument ID leads to sql injection. The attack can be execute
- 9.8 Critical severity
School Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in ProjectsAndPrograms School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file owner_panel/fetch-data/select-students.php. This manipulation of the argument select causes sql injection. Remote
- 9.8 Critical severity
Online Hotel Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/updateaddress.php. The manipulation of the argument address results in sql injection. The attack may be launched remotely. Th
- 8.8 High severity
Open Source Job Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/category/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack may be ini