Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Placement Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add_company.php. The manipulation of the argument Name leads to sql injection. The attack may be i
- 8.8 High severity
webarena: Improper Control of Generation of Code
A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluation_harness/evaluators.py. The manipulation of the argument target["url"]
- 7.5 High severity
Patient Record Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /edit_spatient.php. The manipulation of the argument ID leads to sql injection. It is possible to init
- 9.8 Critical severity
Old Age Home Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument fname leads to sql injection. The attack may
- 9.8 Critical severity
Art Gallery Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/manage-art-medium.php. The manipulation of the argument artmed leads to s
- 9.8 Critical severity
Art Gallery Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /patient-report.php. The manipulation of the argument searchdata leads to sql injection. The at
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument username/contactno leads to sql inject
- 9.8 Critical severity
Membership Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file renew.php?id=6. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely
- 8.8 High severity
N150RT: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiat
- 7.5 High severity
CAS: Improper Control of Generation of Code
A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleF
- 7.2 High severity
Hotel Broadband Operation System: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manager/system/nlog_down.php. The manipulation of the argument ProtocolType leads to
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /new-user-testing.php. The manipulation of the argument mobilenumber leads to sql injection. It is po
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit-phlebotomist.php?pid=11. The manipulation of the argument mobilenumber leads to sql injecti
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in PHPGurukul COVID19 Testing Management System 1.0. This affects an unknown part of the file /check_availability.php. The manipulation of the argument mobnumber leads to sql injection. It is possibl
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /bwdates-report-result.php. The manipulation of the argument todate leads to
- 9.8 Critical severity
COVID19 Testing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. T
- 8.8 High severity
News Publishing Site Dashboard: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /api.php. The manipulation of the argument cat_id leads to sql injection. The attack can be init
- 9.8 Critical severity
springboot-admin: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in opplus springboot-admin 1.0 and classified as critical. This issue affects some unknown processing of the file \src\main\resources\mapper\sys\SysLogDao.xml. The manipulation of the argument order leads to sql injection. The attack
- 9.8 Critical severity
novel-cloud: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in 201206030 novel-cloud 1.4.0 and classified as critical. This vulnerability affects the function RestResp of the file novel-cloud-master/novel-book/novel-book-service/src/main/resources/mapper/BookInfoMapper.xml. The manipulati
- 7.5 High severity
Patient Record Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file /edit_rpatient.php.php. The manipulation of the argument id/lastname leads to sql injection. It is possi
- 9.8 Critical severity
Novel-Plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attac
- 9.8 Critical severity
WebServer: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in markparticle WebServer up to 1.0. This affects an unknown part of the file code/http/httprequest.cpp of the component Login. The manipulation of the argument username/password leads to sql injection. It
- 9.8 Critical severity
WebServer: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in markparticle WebServer up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file code/http/httprequest.cpp of the component Registration. The manipulation of the argument username/pa
- 9.8 Critical severity
DS-Java: Improper Control of Generation of Code
A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the file src/com/phn/action/FileUpload.java. The manipulation of the argument fileUpload leads to code injection. The attack
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/todate leads to sql injection. I
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/view-appointment.php?viewid=11. The manipulation of the argument remark leads to sql injection. Th
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack c
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to
- 8.8 High severity
Online Eyewear Shop: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /oews/classes/Master.php?f=delete_stock. The manipulation of the argument ID leads to sql inject
- 9.8 Critical severity
WCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in WCMS 11 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/controllers/AnonymousController.php. The manipulation of the argument mobile_phone leads to sql injection. The atta
- 9.8 Critical severity
WCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in WCMS 11. Affected is an unknown function of the file app/controllers/AnonymousController.php. The manipulation of the argument email/username leads to sql injection. It is possible to launch the a
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The e
- 8.8 High severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/contact-us.php. The manipulation of the argument pagetitle/pagedes/email/mobnumber/timing leads to sql injectio
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initia
- 8.8 High severity
Web-based Pharmacy Product Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-product.php. The manipulation of the argument ID leads to sql inj
- 8.8 High severity
Web-based Pharmacy Product Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of the file /search/search_stock. php. The manipulation of the argument Name leads to sql injection. Th
- 9.8 Critical severity
Web-based Pharmacy Product Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part of the component Login Handler. The manipulation of the argument login_email leads to sql injection. It is po
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/edit-services.php. The manipulation of the argument cost leads to sql injection. The attack may be
- 9.8 Critical severity
Men Salon Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-customer-detailed.php. The manipulation of the argument editid leads to sql injection. The