Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 8.8 High severity
oa_system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads to sql injection. The
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The attack can be initiated
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/editOrder.php. The manipulation leads to sql injection. It is possible to initiate the attack re
- 9.8 Critical severity
Payroll Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in code-projects Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /Payroll_Management_System/ajax.php?action=save_department. The manipulation of t
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/editProduct.php. The manipulation of the argument editProductName leads to sql injecti
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/removeProduct.php. The manipulation of the argument productId leads to sql injection.
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/createOrder.php. The manipulation leads to sql injection. It is possible to initiate the attack
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /php_action/createProduct.php. The manipulation of the argument productName leads to sql inj
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/removeBrand.php. The manipulation of the argument brandId leads to sq
- 7.5 High severity
Roo-Code: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's `search_files` tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was abl
- 9.8 Critical severity
Food Distributor Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in code-projects Food Distributor Site 1.0. This issue affects some unknown processing of the file /admin/process_login.php. The manipulation of the argument username/password leads to sql injec
- 9.8 Critical severity
openvpn-cms-flask: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads
- 8.8 High severity
hosp_order: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument office
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/fetchSelectedBrand.php. The manipulation of the argument brandId leads to sql injection. It is
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/editBrand.php. The manipulation of the argument editBrandStatus leads
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/removeCategories.php. The manipulation of the argument categoriesId leads to sql injec
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/createBrand.php. The manipulation of the argument brandStatus leads to sql injection.
- 10.0 Critical severity
Cisco Identity Services Engine Injection Exploited
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerabi
- 7.2 High severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/editempprofile.php. The manipulation of the argument FirstName leads to sql injection. It is pos
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /panel/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /panel/edit-services.php. The manipulation of the argument editid leads to sql
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/stock.php. The manipulation of the argument ID leads to sql injection. It is possible to launch
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. This issue affects some unknown processing of the file /panel/add-services.php. The manipulation of the argument Type leads to sql injection.
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown code of the file /panel/edit-staff.php. The manipulation of the argument editid leads to sql injection. The attack can be in
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add-staff.php. The manipulation of the argument Name leads to sql injection. It is possible to initiate th
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /view-appointment.php. The manipulation of the argument viewid leads to sql injection. It is possible to i
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /edit-customer-detailed.php. The manipulation of the argument editid leads to
- 8.8 High severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-customer.php. The manipulation of the argument name/email/mobilenum/gender/details/
- 9.8 Critical severity
Best Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the component Login. The manipulation of the argument Username leads to sql injection. It is possible to launch the att
- 9.8 Critical severity
Car Rental System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /message_admin.php. The manipulation of the argument Message leads to sql injection. The attack may be initi
- 9.8 Critical severity
Simple Online Hotel Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_account.php. The manipulation of the argument admin_id leads to sql injec
- 8.8 High severity
Hospital Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown functionality of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql inject
- 9.8 Critical severity
Online Recruitment Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file Recruitment/admin/view_application.php. The manipulation of the argument ID leads to sql inje
- 8.8 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/fetchSelectedCategories.php. The manipulation of the argument categoriesId leads to sql in
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. The
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection.
- 9.8 Critical severity
Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in code-projects Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /php_action/editCategories.php. The manipulation of the argument editCategories
- 9.8 Critical severity
Agri-Trading Online Shopping System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Agri-Trading Online Shopping System 1.0 and classified as critical. This vulnerability affects unknown code of the file /transactionsave.php. The manipulation of the argument del leads to sql injection. The attack
- 7.2 High severity
Online Shopping Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Online Shopping Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument cat_id/brand_id/keyword/proId/pid leads to sql injec