Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
DIR-880L: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdocs/ssdpcgi of the component Request Header Handler. The manipulation of the argument HTTP_ST/REMOTE_AD
- 9.8 Critical severity
DIR-890L: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remo
- 9.8 Critical severity
Company Visitor Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /visitor-detail.php. The manipulation of the argument editid/remark leads to sql injectio
- 9.8 Critical severity
Online Student Clearance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Online Student Clearance System 1.0. This vulnerability affects unknown code of the file /Admin/login.php. The manipulation of the argument id/username/password leads to sql injection. The atta
- 9.8 Critical severity
Advanced Web Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Advanced Web Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation of the argument txtLogin leads to sql injection. The a
- 9.8 Critical severity
Advanced Web Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Advanced Web Store 1.0. Affected is an unknown function of the file /admin/admin_addnew_product.php. The manipulation of the argument txtProdId leads to sql injection. It is possibl
- 9.8 Critical severity
Advanced Web Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Advanced Web Store 1.0. This issue affects some unknown processing of the file /productdetail.php. The manipulation of the argument prodid leads to sql injection. The attack ma
- 9.8 Critical severity
Content Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /admin/update_main_topic_img.php?topic_id=529. The manipulation of the argument stopic_id leads to sql injection
- 9.8 Critical severity
Art Gallery Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add-art-type.php. The manipulation of the argument arttype leads to sql injection.
- 9.8 Critical severity
Art Gallery Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-art-type.php. The manipulation of the argument arttype leads to sql i
- 9.8 Critical severity
Art Gallery Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been classified as critical. Affected is an unknown function of the file /admin/add-art-medium.php. The manipulation of the argument artmed leads to sql injection. It is possible
- 9.8 Critical severity
Nipah Virus Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /edit-phlebotomist.php. The manipulation of the argument mobilenumber leads to sql injection. T
- 9.8 Critical severity
Cyber Cafe Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in PHPGurukul Cyber Cafe Management System 1.0. This affects an unknown part of the file /adminprofile.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to ini
- 9.8 Critical severity
Human Metapneumovirus Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /add-phlebotomist.php. The manipulation of the argument empid
- 9.8 Critical severity
Content Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search-notice.php. The manipulation of the argument searchdata leads to sql injection. The a
- 9.8 Critical severity
Content Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the file /search_list.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the atta
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/change-password.php. The manipulation leads to sql injection. It is possible to initiate the attack rem
- 9.8 Critical severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. T
- 7.2 High severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. This affects an unknown part of the file /admin/?page=purchase_order/view_po of the component Purchase Order Details Page. The manipulation of
- 9.8 Critical severity
Notice Board System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. Affected by this issue is some unknown functionality of the file /bwdates-reports-details.php?vid=2. The manipulation of the argument fromdate/tomdate lead
- 9.8 Critical severity
Emergency Ambulance Hiring Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/contact-us.php. The manipulation of the argument mobnum leads to sql injection.
- 9.8 Critical severity
Emergency Ambulance Hiring Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/edit-ambulance.php. The manipulation of the argument dconnum leads to sql injection. It is possible to
- 9.8 Critical severity
Online DJ Booking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to sql injection
- 9.8 Critical severity
Online DJ Booking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/user-search.php. The manipulation of the argument searchdata leads to sql injection. T
- 9.8 Critical severity
Nero Social Networking Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument fname/lname/login/password2/cpassword/address/cnumber/email/ge
- 9.8 Critical severity
e-Diary Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGurukul e-Diary Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage-categories.php. The manipulation of the argument ID leads to sql injection. The attack ma
- 9.8 Critical severity
Simple To-Do List System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Simple To-Do List System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /complete_task.php. The manipulation of the argument ID leads to sql injection. The
- 8.8 High severity
Simple To-Do List System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Simple To-Do List System 1.0. Affected is an unknown function of the file /delete_task.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the
- 8.8 High severity
Online Bus Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seatlocation.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate
- 8.8 High severity
Online Bus Reservation System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown functionality of the file /print.php. The manipulation of the argument ID leads to sql injection. The a
- 9.8 Critical severity
Online Birth Certificate System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql i
- 9.8 Critical severity
Teacher Subject Allocation Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possi
- 9.8 Critical severity
Cyber Cafe Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. This affects an unknown part of the file /add-computer.php. The manipulation of the argument compname/comploc leads to sql injection. It is possible
- 7.8 High severity
browserpilot: Improper Control of Generation of Code
A vulnerability was found in handrew browserpilot up to 0.2.51. It has been declared as critical. Affected by this vulnerability is the function GPTSeleniumAgent of the file browserpilot/browserpilot/agents/gpt_selenium_agent.py. The manipulation of the argume
- 9.8 Critical severity
Online DJ Booking Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql
- 9.8 Critical severity
Online Birth Certificate System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Online Birth Certificate System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. The attack c
- 8.8 High severity
Patient Record Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_xpatient.php. The manipulation of the argument lastname leads to sql injection. It is possible to lau
- 8.8 High severity
Patient Record Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Patient Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /birthing.php. The manipulation of the argument comp_id leads to sql injection. The attack m
- 9.8 Critical severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_member. The manipulation of the argument umember_id leads to sql injection. The att
- 9.8 Critical severity
Restaurant Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_update.php. The manipulation of the argument Category leads to sql injection