Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,033 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.3 High severity
Online Medicine Delivery System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results
- 7.3 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. Th
- 7.3 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. T
- 7.4 High severity
NR1800X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is
- 7.4 High severity
DIR-825M: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injectio
- 9.8 Critical severity
Tutor LMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the a
- 9.9 Critical severity
Plesk: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.
- 9.4 Critical severity
BigQuery Data Transfer Service: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector
- 8.3 High severity
N600R: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be in
- 7.3 High severity
Simple Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out
- 7.3 High severity
Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Performing a manipulation of the argument search_box results in sql
- 7.3 High severity
node-poppler: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the com
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible t
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be
- 7.3 High severity
Online Clinic Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exp
- 7.3 High severity
Real Estate Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sq
- 7.3 High severity
Payroll System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is p
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads to sql injection. Th
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may b
- 7.3 High severity
XBROTHER Dynamic Environment Monitoring System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmed
- 7.3 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initi
- 7.3 High severity
Barangay Resident Profiling Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql inj
- 7.4 High severity
CH22: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disc
- 7.4 High severity
CH22: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. T
- 7.4 High severity
TEW-821DAP: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remot
- 9.9 Critical severity
CF-N1-S: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack ca
- 7.4 High severity
CH22: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely.
- 7.3 High severity
Apartment Visitor Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitatio
- 7.3 High severity
Apartment Visitor Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launc
- 7.4 High severity
CF-N1-S: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. Th
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=delete_category. Such manipulation of the argument ID leads to sql injection. It
- 7.3 High severity
Simple Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from
- 7.3 High severity
Simple Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exp
- 7.3 High severity
DeDeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has be
- 7.3 High severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote e
- 7.3 High severity
Assessment Management: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is
- 7.3 High severity
cc-connect: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The
- 7.4 High severity
TEW-755AP: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carri