Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The exploit has been mad
- 9.8 Critical severity
CourseSelectionSystem: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. The impacted element is an unknown function of the file /Profilers/PriProfile/COUNT3s5.php. Performing manipulation of the argument csslc results in sql injection. The attack can be
- 7.3 High severity
LQ_04: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. This affects an unknown function of the file /usb_paswd.asp. The manipulation of the argument Name leads to command injection. The attack can be initiated remotely. The expl
- 8.8 High severity
Open Source Job Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Open Source Job Portal 1.0. Affected by this issue is some unknown functionality of the file /admin/user/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack is possible to b
- 9.8 Critical severity
Hostel Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Hostel Management System 1.0. Affected by this issue is some unknown functionality of the file /justines/admin/mod_users/index.php?view=view. The manipulation of the argument ID results in sql injection. The attack
- 9.8 Critical severity
Computer Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us_edit1.php. The manipulation of the argument ID leads to sql injection. Remote expl
- 8.8 High severity
Online Clinic Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Affected is an unknown function of the file /details.php?action=post. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely.
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/admin_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack may be initiated remote
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/admin_account_update.php. Such manipulation of the argument user_id leads to sql injection. The attack can be launched remotely. The exp
- 9.8 Critical severity
CourseSelectionSystem: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Impacted is an unknown function of the file /Profilers/PriProfile/COUNT3s7.php. The manipulation of the argument cbe leads to sql injection. It is po
- 9.8 Critical severity
CourseSelectionSystem: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This issue affects some unknown processing of the file /Profilers/PriProfile/COUNT3s6.php. Executing manipulation of the argument CPU can lead to sql injectio
- 7.2 High severity
MuYuCMS: Improper Control of Generation of Code
A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template Management. The manipulation results in code injection. It is possible to launch the attack remotely
- 7.3 High severity
Resume-management-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273. Affected by this issue is some unknown functionality of the file /admin/show.php. This manipulation of the argument userid causes sql injection. The att
- 7.3 High severity
PHP-Usermm: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Performing manipulation of the argument Username results in sql injection. The attack may be initiated
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remo
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch the attack remotely. T
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac_5g leads to command injection. It is possible to initiat
- 8.0 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument delete_list results in command injection. The
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be executed remotely. The
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploitation of the attack is
- 9.8 Critical severity
Point of Sale System POS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be
- 9.8 Critical severity
Gym Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack rem
- 8.8 High severity
Society Membership Information System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.php. Such manipulation of the argument student_id leads to sql injection. The attack may be performed f
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotel
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been mad
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible
- 9.8 Critical severity
Online Hotel Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/paypalpayout.php. Executing manipulation of the argument confirm can lead to sql injection. The attack
- 9.8 Critical severity
Online Bidding System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/wew.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit
- 9.8 Critical severity
Online Bidding System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The
- 8.8 High severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be initiated remotely. T
- 8.8 High severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is possible to launch the
- 9.8 Critical severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/print1.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The
- 8.8 High severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/view_payorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated
- 9.8 Critical severity
Open Source Job Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument user_email leads to sql injection. It is possible to launch the attack remotel
- 9.8 Critical severity
Bookstore Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in 1000projects Bookstore Management System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument unm causes sql injection. It is possible to initiate the attack remotely. The
- 9.8 Critical severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Pet Grooming Management Software 1.0. The affected element is an unknown function of the file /admin/fetch_product_details.php. The manipulation of the argument barcode results in sql injection. The attack may be per
- 9.8 Critical severity
Computer Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. The manipulation of the argument prodcode leads to sql injection. The attack is possible to be carried out re
- 9.8 Critical severity
Computer Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/inv_edit1.php. Executing manipulation of the argument idd can lead to sql injection. The attack can be executed remotely.
- 9.8 Critical severity
Computer Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Campcodes Computer Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/sup_edit1.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack