Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 10.0 Critical severity
MindSearch: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack c
- 7.3 High severity
HospitalManagementSystem: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file edit_accounts.php. This manipulation of the argument user_id/patient_id/physician_id/discounts_
- 7.3 High severity
Online Reviewer Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the ar
- 7.3 High severity
Restaurant-Management-System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injectio
- 7.3 High severity
Restaurant-Management-System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of
- 7.3 High severity
Restaurant-Management-System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argum
- 7.3 High severity
Restaurant-Management-System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a man
- 7.3 High severity
Car Driving School Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection. The attack can be executed remotely. T
- 7.3 High severity
Online Reviewer Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in
- 7.3 High severity
Online Reviewer Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection
- 7.3 High severity
Online Reviewer Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploi
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the a
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote.
- 7.3 High severity
WorkFlow-Engine: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processI
- 7.3 High severity
kykms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the
- 8.7 High severity
Administrator: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console.
- 7.4 High severity
SurfSense: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is pos
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has bee
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The e
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql inj
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can
- 9.1 Critical severity
BaoTa: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command in
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection.
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The e
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attac
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql i
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initia
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The
- 7.3 High severity
CloudClassroom-PHP-Project: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipula
- 7.3 High severity
CloudPos: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The atta
- 9.3 Critical severity
kitty: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, beca
- 10.0 Critical severity
Decepticon: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring
- 7.3 High severity
MicroCommunity: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection.
- 7.3 High severity
Project-Management-Software: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection.