Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_payroll. The manipulation of the argument ID leads to sql injection. The
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_employee_attendance. The manipulation of the argument employee_
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_payroll. The manipulation of the argument ID leads to sql injection. It is possible to
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_employee_attendance_single. The manipulation of the argument ID leads to sql injecti
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=calculate_payroll. The manipulation of the argument ID leads to sql injection. The attack
- 7.2 High severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown part of the file /admin/changepassword.php. The manipulation of the argument currentpassword leads to sql injection. It i
- 7.2 High severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in itsourcecode Employee Management System up to 1.0. Affected by this issue is some unknown functionality of the file /admin/adminprofile.php. The manipulation of the argument AdminName leads t
- 7.2 High severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editempeducation.php. The manipulation of the argument coursepg leads to sql in
- 7.2 High severity
Complaint Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/complaint-details.php. The manipulation of the argument cid/uid leads to sql injection. The att
- 9.8 Critical severity
Complaint Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Complaint Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack can be
- 8.8 High severity
Complaint Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Complaint Management System 1.0. It has been classified as critical. This affects an unknown part of the file /users/complaint-details.php. The manipulation of the argument cid leads to sql injection. It is possible to in
- 9.8 Critical severity
Complaint Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /users/check_availability.php. The manipulation of the argument email leads to sql injection. Th
- 9.8 Critical severity
Complaint Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Complaint Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /users/index.php. The manipulation of the argument Username leads to sql injection. T
- 9.8 Critical severity
BoyunCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be
- 9.8 Critical severity
BoyunCMS: Improper Control of Generation of Code
A vulnerability was found in BoyunCMS up to 1.4.20. It has been classified as critical. This affects an unknown part of the file /install/install_ok.php of the component Configuration File Handler. The manipulation of the argument db_pass leads to code injecti
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /myprofile.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated r
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in Campcodes Employee Management System 1.0. This affects an unknown part of the file /myprofileup.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the atta
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in Campcodes Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /mark.php. The manipulation of the argument ID leads to sql injection. The attack ma
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Campcodes Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /empproject.php. The manipulation of the argument ID leads to sql injection. The attack can be
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in Campcodes Employee Management System 1.0. Affected is an unknown function of the file /eloginwel.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remot
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Employee Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remo
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Employee Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /process/eprocess.php. The manipulation of the argument mailuid leads to sql injection. The attack can
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /changepassemp.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the a
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /process/aprocess.php. The manipulation of the argument mailuid leads to sql injection. The attac
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /applyleave.php. The manipulation of the argument ID leads to sql injection. The attac
- 9.8 Critical severity
Simple Pizza Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /editcus.php. The manipulation of the argument ID leads to sql injection. The attack may be initi
- 9.8 Critical severity
Simple Pizza Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /large.php. The manipulation of the argument ID leads to sql injection. The attack can be initiat
- 9.8 Critical severity
Simple Pizza Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /addpro.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the at
- 9.8 Critical severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/payment_add.php. The manipulation of the argument cid leads to sql injection. The attack m
- 8.8 High severity
Zoo Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to launch
- 8.8 High severity
Zoo Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/view-normal-ticket.php. The manipulation of the argument viewid leads to sql injection. The attack m
- 9.8 Critical severity
Online Hotel Booking: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in code-projects Online Hotel Booking 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/registration.php. The manipulation of the argument uname leads to sql injection. The attack can be i
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul Student Record System 3.2. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument session leads to sql injection. The atta
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in PHPGurukul Student Record System 3.2. Affected by this vulnerability is an unknown functionality of the file /edit-student.php. The manipulation of the argument fmarks2 leads to sql injection. The attack can
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attack
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been rated as critical. This issue affects some unknown processing of the file /manage-students.php. The manipulation of the argument del leads to sql injection. The attack may be initia
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads to sql injection. The attack can be initia
- 8.8 High severity
Student Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. The manipulation of the argument session leads to sql injection. It is possible to initiate the attack
- 8.8 High severity
Old Age Home Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql i
- 8.8 High severity
Old Age Home Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument sertitle leads to sql injection. It is possibl