Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.8 High severity
stats: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the
- 8.8 High severity
Jeewms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql
- 8.8 High severity
Jeewms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. ja
- 9.8 Critical severity
Admission Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Admission Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php of the component Login. The manipulation of the argument u_id leads to sql injection. Th
- 8.8 High severity
cy-fast: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this issue is the function listData of the file /sys/menu/listData. The manipulation of the argument order leads to sql injection. The attack may be launched remotely. The
- 8.8 High severity
cy-fast: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched
- 9.8 Critical severity
Cinema Seat Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in code-projects Cinema Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/deleteBooking.php. The manipulation of the argument id leads to sql injection. T
- 9.8 Critical severity
Project Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/teacher.php. The manipulation of the argument name leads to sql injection. It is possible to initiate
- 8.8 High severity
cy-fast: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /sys/user/listData. The manipulation of the argument order leads to sql injection. The attack can be launched
- 8.8 High severity
cy-fast: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely.
- 7.3 High severity
ECT Platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation
- 8.0 High severity
E-Commerce-PHP: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blog_id leads to sql injection. The att
- 8.8 High severity
Sucms: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac=search. The manipulation of the argument uid leads to sql injection. The attack may be launched remo
- 8.8 High severity
Online Book Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in code-projects Online Book Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /subcat.php. The manipulation of the argument cat leads to sql injection. The attack can be launched
- 9.8 Critical severity
Online Book Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /search_result.php. The manipulation of the argument s leads to sql injection. It is possible to launch the attack remotely
- 9.8 Critical severity
Online Book Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process_login.php. The manipulation of the argument usernm leads to sql injection. The attack may be initiat
- 9.8 Critical severity
Online Book Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attack
- 8.8 High severity
Home Clean Services Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /public_html/admin/process.php. The manipulation of the argument type/
- 9.8 Critical severity
Project Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/course.php. The manipulation of the argument course_name leads to sql injection. It is possible to in
- 8.8 High severity
Blood Bank Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /successadmin.php. The manipulation of the argument psw leads to sql injection. The attack may b
- 8.8 High severity
Gym Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql inj
- 9.8 Critical severity
Responsive Hotel Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the att
- 9.8 Critical severity
Travel Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in code-projects Travel Management System 1.0. This issue affects some unknown processing of the file /enquiry.php. The manipulation of the argument pid/t1/t2/t3/t4/t5/t6/t7 leads to sql injecti
- 9.8 Critical severity
Student Grading System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Student Grading System 1.0. It has been classified as critical. This affects an unknown part of the file /view_students.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attac
- 9.8 Critical severity
School Faculty Scheduling System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to
- 9.8 Critical severity
Online Shoe Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remot
- 9.8 Critical severity
Online Shoe Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument password leads to sql injection. Th
- 9.8 Critical severity
Online Shoe Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /details2.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. T
- 9.8 Critical severity
Online Shoe Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remote
- 9.8 Critical severity
Student Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Student Management System 1.0. It has been declared as critical. This vulnerability affects the function showSubject1 of the file /config/DbFunction.php. The manipulation of the argument sid leads to sql injection. Th
- 7.5 High severity
Point of Sales and Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql inject
- 7.5 High severity
Online Eyewear Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /orders/view_order.php. The manipulation of the argument id leads to sql injection. The attack may
- 7.5 High severity
Chat System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deleteroom.php. The manipulation of the argument id leads to sql injection. The attack can
- 7.5 High severity
Chat System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack re
- 7.5 High severity
Job Recruitment: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /_parse/_call_main_search_ajax.php of the component Seeker Profile Handler. The manipulation of the a
- 7.5 High severity
Job Recruitment: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /_parse/_call_job/search_ajax.php of the component Job Post Handler. The manipulation of the argument n leads to sql inje
- 7.5 High severity
Job Recruitment: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the at
- 9.8 Critical severity
Land Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in PHPGurukul Land Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The att
- 9.8 Critical severity
Land Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in PHPGurukul Land Record System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search-property.php. The manipulation of the argument searchdata leads to sql injection. The at
- 8.8 High severity
Land Record System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/property-details.php. The manipulation of the argument editid leads to sql injection. The attack