Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Online Lawyer Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in projectworlds Online Lawyer Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /save_lawyer_edit_profile.php. The manipulation leads to sql injection. The attack can be init
- 9.8 Critical severity
Online Marriage Registration System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Online Marriage Registration System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/between-dates-application-report.php. The manipulation of the argument fromdate/todate leads to
- 9.8 Critical severity
Daily Expense Tracker System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /expense-monthwise-reports-detailed.php. The manipulation of the argument fromdate/
- 9.8 Critical severity
Client Database Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /user_void_transaction.php. The manipulation of the argument order_id leads to sql injection. It i
- 9.8 Critical severity
Auto Taxi Stand Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function of the file /admin/new-autoortaxi-entry-form.php. The manipulation of the argument drivername leads to sql injection. It
- 9.8 Critical severity
Auto Taxi Stand Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection.
- 9.8 Critical severity
Auto Taxi Stand Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/auto-taxi-entry-detail.php. The manipulation of the argument price leads to sql injectio
- 9.8 Critical severity
Auto Taxi Stand Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possibl
- 9.8 Critical severity
Auto Taxi Stand Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The a
- 9.8 Critical severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/view-foreigner-ticket.php. The manipulation of the argument viewid leads to sql injection. It is possible t
- 9.8 Critical severity
Zoo Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown processing of the file /admin/edit-animal-details.php. The manipulation of the argument aname leads to sql injection. The
- 9.8 Critical severity
Daily Expense Tracker System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul Daily Expense Tracker System 1.1. This affects an unknown part of the file /expense-datewise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. It i
- 9.8 Critical severity
Daily Expense Tracker System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The a
- 9.8 Critical severity
Notice Board System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Notice Board System 1.0. It has been classified as critical. Affected is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack r
- 9.8 Critical severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/payment.php. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack
- 9.8 Critical severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pages/transaction_update.php. The manipulation of the argument ID leads to sql injection. The attack m
- 9.8 Critical severity
Doctors Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing of the file /admin/delete-session.php. The manipulation of the argument ID leads to sql injection. Th
- 9.8 Critical severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/product_update.php. The manipulation of the argument serial leads to sql injection. T
- 9.8 Critical severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument serial leads to sql injection. It is possible to launch t
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/assign_save.php. The manipulation of the argument team leads to sql injection. The attack m
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team_update.php. The manipulation of the argument team leads to sql injection. It is possible to ini
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/user_save.php. The manipulation of the argument username/name leads to sql injection.
- 9.8 Critical severity
News Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. The attack ca
- 9.8 Critical severity
Online Shopping Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be init
- 9.8 Critical severity
News Portal Project: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may
- 9.8 Critical severity
News Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument Username leads to sql inje
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in itsourcecode Restaurant Management System 1.0. This vulnerability affects unknown code of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. The attack can be initiat
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. This affects an unknown part of the file /admin/member_update.php. The manipulation of the argument menu leads to sql injection. It is possible to initiate
- 8.8 High severity
rill-flow: Improper Control of Generation of Code
A vulnerability was found in weibocom rill-flow 0.1.18. It has been classified as critical. Affected is an unknown function of the component Management Console. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/member_save.php. The manipulation of the argument last leads to sql injection. The attack may b
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode Restaurant Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/finished.php. The manipulation of the argument ID leads to sql injection. The attack can be i
- 8.6 High severity
GEMS ERP Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to in
- 9.8 Critical severity
Beauty Parlour Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql in
- 9.8 Critical severity
N300RH: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attac
- 9.8 Critical severity
N300RH: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to command injectio
- 9.8 Critical severity
Student Project Allocation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in projectworlds Student Project Allocation System 1.0. This affects an unknown part of the file /make_group_sql.php. The manipulation of the argument mem1/mem2/mem3 leads to sql injection. It is possible t
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /deleteAgent.php. The manipulation of the argument agent_id leads to sql injection.
- 7.2 High severity
cocotais-bot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Cocotais Bot is a QQ official robot framework based on qq-bot-sdk. Starting in version 1.5.0-test2-hotfix and prior to version 1.6.2, command echoing feature in the framework allows users to indirectly trigger privileged behavior by injecting special platform
- 9.8 Critical severity
Doctor's Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Doctor's Appointment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/delete-doctor.php of the component GET Parameter Handler. The manipulation of the argument
- 9.8 Critical severity
Doctor's Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Sourcecodester Doctor's Appointment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete-appointment.php of the component GET Parameter Handler. The manipulation of the arg