Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 8.8 High severity
ChanCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The explo
- 8.6 High severity
Stratix IOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication.
- 9.8 Critical severity
DIR-823X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be la
- 7.2 High severity
Maccms10: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit
- 9.8 Critical severity
E-Logbook with Health Monitoring System for…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. The attac
- 7.3 High severity
SiempreCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly d
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made
- 9.8 Critical severity
Student Information Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in itsourcecode Student Information Management System 1.0. This affects an unknown function of the file /admin/modules/room/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be per
- 9.8 Critical severity
Student Information Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/department/index.php. This manipulation of the argument ID causes sql injection. The attack is poss
- 9.8 Critical severity
Student Information Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/modules/instructor/index.php. The manipulation of the argument ID results in sql injection. The attack
- 8.8 High severity
ChanCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in ChanCMS up to 3.3.1. Impacted is an unknown function of the file /search/. The manipulation with the input '%20or%201=1%20%23/words.html leads to sql injection. Remote exploitation of the attack is possible. The exploit is pub
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Campcodes Online Loan Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_payment. Executing manipulation of the argument ID can lead to sql injection. The attack may be launch
- 9.8 Critical severity
Online Loan Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Online Loan Management System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_loan. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotel
- 8.8 High severity
ChanCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.1. This affects an unknown part of the file /cms/collect/search. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit has been disclo
- 8.8 High severity
ChanCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in yanyutao0402 ChanCMS up to 3.3.1. Affected by this issue is some unknown functionality of the file /cms/article/search. This manipulation of the argument keyword causes sql injection. The attack can be initiated remotely. The exploit h
- 9.8 Critical severity
Online Event Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /review_search.php. The manipulation of the argument txtsearch leads to sql injection. It is possible to initiate the attac
- 9.8 Critical severity
Online Event Judging System: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /home.php. Executing manipulation of the argument main_event can lead to sql injection. The attack may be performed from remote. The e
- 9.8 Critical severity
Online Event Judging System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown function of the file /index.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out r
- 9.8 Critical severity
Simple Forum Discussion System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Simple Forum Discussion System 1.0. This impacts an unknown function of the file /admin_class.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate
- 8.8 High severity
User Management System: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The manipulation of the argument uid results in sql injection. The attack may be performed from remote. The
- 9.8 Critical severity
sim: Improper Control of Generation of Code
A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remo
- 9.8 Critical severity
OA: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exp
- 7.2 High severity
Pet Grooming Management Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/profit_report.php. Such manipulation of the argument product_id leads to sql injection. The attack can be laun
- 9.8 Critical severity
Online Polling System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/manage-admins.php. Such manipulation of the argument email leads to sql injection. The attack can be executed remotely. The exploit h
- 9.8 Critical severity
Small CRM: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be executed remotely. The exploit
- 9.8 Critical severity
Online Polling System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/candidates.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The
- 9.8 Critical severity
Online Polling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Online Polling System 1.0. This impacts an unknown function of the file /registeracc.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The expl
- 9.8 Critical severity
Online Polling System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Online Polling System 1.0. This affects an unknown function of the file /manage-profile.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has be
- 9.8 Critical severity
Online Discussion Forum: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely.
- 9.8 Critical severity
Student Information Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing manipulation of the argument uname can lead to sql injection. The attack may be launched remotely. Th
- 9.8 Critical severity
Online Discussion Forum: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit has been di
- 9.8 Critical severity
Grocery Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Campcodes Grocery Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=delete_sales. The manipulation of the argument ID leads to sql injection. Remote exploitation of the at
- 9.8 Critical severity
Grocery Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=save_receiving. Executing manipulation of the argument ID can lead to sql injection. The attack may be l
- 9.8 Critical severity
Online Course Registration: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.php. The manipulation of the argument semester leads to sql injection. It is possible to initiate the attack remotely. The
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be ex
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possibl
- 9.8 Critical severity
N600R: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. Th
- 9.8 Critical severity
X5000R: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument pid results in command injection. Remote exploitation of the attack is possible.
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. Such manipulation of the argument viewid leads to sql injection. The attack may be
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-image.php. This manipulation of the argument lid causes sql injection. The attack may be initiated re