Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 8.8 High severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. Affected is an unknown function of the file /admin/reg-users.php. The manipulation of the argument del leads to sql injection. It is possible to
- 8.8 High severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchdata leads to sql injection. The
- 8.8 High severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in PHPGurukul Vehicle Parking Management System 1.13. Affected is an unknown function of the file /admin/view-outgoingvehicle-detail.php. The manipulation of the argument viewid leads to sql injection. It i
- 9.8 Critical severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been rated as critical. This issue affects some unknown processing of the file /users/forgot-password.php. The manipulation of the argument email leads to sql injection. The
- 8.8 High severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been declared as critical. This vulnerability affects unknown code of the file /users/print.php. The manipulation of the argument vid leads to sql injection. The attack can
- 8.8 High severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /users/profile.php. The manipulation of the argument firstname leads to sql injection. It is possible t
- 9.8 Critical severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality of the file /users/signup.php. The manipulation of the argument email leads to sql injection. The at
- 8.8 High severity
Vehicle Parking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /users/view--detail.php. The manipulation of the argument viewid leads to sql
- 9.8 Critical severity
Modern Bag: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. Affected is an unknown function of the file /admin/category-list.php. The manipulation of the argument idCate leads to sql injection. It is possible to launch the att
- 9.8 Critical severity
Simple Car Rental System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. This vulnerability affects unknown code of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remo
- 9.8 Critical severity
Simple Car Rental System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part of the file /pay.php. The manipulation of the argument mpesa leads to sql injection. It is possible to initiate the attack remotel
- 9.8 Critical severity
Job Diary: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Job Diary 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search.php. The manipulation of the argument Search leads to sql injection. The attack may be launched re
- 9.8 Critical severity
Modern Bag: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/login-back.php. The manipulation of the argument user-name leads to sql injection. The at
- 9.8 Critical severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/product_add.php. The manipulation of the argument prod_name leads to sql injection. The attack may b
- 9.8 Critical severity
Modern Bag: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This affects an unknown part of the file /product-detail.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remote
- 9.8 Critical severity
ABC Courier Management: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Management 1.0. Affected by this issue is some unknown functionality of the file /add_dealerrequest.php. The manipulation of the argument Name leads to sql injection.
- 9.8 Critical severity
Modern Bag: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument proId leads to sql injection. The attack may be launched remote
- 9.8 Critical severity
Mobile Shop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in code-projects Mobile Shop 1.0. This vulnerability affects unknown code of the file /EditMobile.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploi
- 9.8 Critical severity
Online Movie Theater Seat Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects an unknown part of the file /admin/manage_movie.php. The manipulation of the argument ID leads to sql injection. It is poss
- 9.8 Critical severity
Online Movie Theater Seat Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this issue is some unknown functionality of the file /reserve.php. The manipulation of the argument ID leads to sql inj
- 9.8 Critical severity
Online Movie Theater Seat Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_reserve.php. The manipulation of the argument mid leads to sql inject
- 9.8 Critical severity
Online Movie Theater Seat Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected is an unknown function of the file /admin/manage_theater.php. The manipulation of the argument ID leads to sql injection. It is possib
- 9.8 Critical severity
Online Recruitment Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_vacancy. The manipulation of the argument ID leads to sql injec
- 8.8 High severity
O3V2: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command in
- 9.8 Critical severity
LifeStyle Store: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /success.php. The manipulation of the argument ID leads to sql injection. The attack can be
- 9.8 Critical severity
LifeStyle Store: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects LifeStyle Store 1.0. It has been classified as critical. Affected is an unknown function of the file /cart_remove.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack re
- 9.8 Critical severity
Mobile Shop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Mobile Shop 1.0 and classified as critical. This issue affects some unknown processing of the file /LoginAsAdmin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_deductions. The manipulation of the argument ID leads to sql in
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_allowances. The manipulation of the argument ID leads to sql injection. It is possible
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_position. The manipulation of the argument ID leads to sql injection. The attack may
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_position. The manipulation of the argument ID leads to sql injection. The attack can
- 8.8 High severity
Insurance Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Insurance Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertAgent.php. The manipulation of the argument agent_id leads to sql injection. The attac
- 9.8 Critical severity
LifeStyle Store: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cart_add.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotel
- 9.8 Critical severity
Pharmacy Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in krishna9772 Pharmacy Management System up to a2efc8442931ec9308f3b4cf4778e5701153f4e5. Affected is an unknown function of the file quantity_upd.php. The manipulation of the argument med_name/med_c
- 9.8 Critical severity
Library System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in code-projects Library System 1.0. This issue affects some unknown processing of the file /notapprove.php. The manipulation of the argument ID leads to sql injection. The attack may be initiat
- 9.8 Critical severity
Jonnys Liquor: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in code-projects Jonnys Liquor 1.0. This vulnerability affects unknown code of the file /admin/admin-area.php. The manipulation of the argument drink leads to sql injection. The attack can be initiated remotely.
- 9.8 Critical severity
Jonnys Liquor: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in code-projects Jonnys Liquor 1.0. This affects an unknown part of the file /admin/delete-row.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely
- 9.8 Critical severity
Jonnys Liquor: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Jonnys Liquor 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /browse.php. The manipulation of the argument Search leads to sql injection. The attack may be launche
- 9.8 Critical severity
Agri-Trading Online Shopping System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/suppliercontroller.php. The manipulation of the argument supplier leads to sql injec
- 8.8 High severity
DIR-645: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated rem