Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 8.8 High severity
Travel Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Travel Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /package.php. The manipulation of the argument subcatid leads to sql injection. The attack can be ini
- 8.8 High severity
Travel Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Travel Management System 1.0. It has been classified as critical. This affects an unknown part of the file /detail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attac
- 9.8 Critical severity
Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /invo.php. The manipulation of the argument dname leads to sql injection. The attack may be launch
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in 1000 Projects Attendance Tracking Management System 1.0. This issue affects some unknown processing of the file /admin/admin_action.php. The manipulation of the argument admin_user_name leads
- 9.8 Critical severity
Simple Car Rental System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. This vulnerability affects unknown code of the file /account.php. The manipulation of the argument email/pass leads to sql injection. The attack can be initiated re
- 9.8 Critical severity
House Rental Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /signin.php. The manipulation of the argument u/p leads to sql injection. The attack may
- 9.8 Critical severity
House Rental Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ownersignup.php. The manipulation of the argument f/e/p/m/o/n/c/s/ci/a leads to
- 9.8 Critical severity
Portfolio Management System MCA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/admin_login.php. The manipulation of the argument username/password leads to sql injection. I
- 8.8 High severity
Blood Donor Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Blood Donor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/deletedannounce.php. The manipulation of the argument id leads to sql injection. The attack may b
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in 1000 Projects Attendance Tracking Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/student_action.php. The manipulation of the argument student_id leads to sql inject
- 7.5 High severity
Job Recruitment: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as critical. This issue affects the function add_edu of the file /_parse/_all_edits.php. The manipulation of the argument degree leads to sql injection. The attack may be initiat
- 9.1 Critical severity
Simple Admin Panel: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in code-projects Simple Admin Panel 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file updateOrderStatus.php. The manipulation of the argument record leads to sql injection. The
- 8.8 High severity
Simple Admin Panel: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in code-projects Simple Admin Panel 1.0. Affected is an unknown function of the file addVariationController.php. The manipulation of the argument qty leads to sql injection. It is possible to launch
- 9.8 Critical severity
Simple Admin Panel: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in code-projects Simple Admin Panel 1.0. This issue affects some unknown processing of the file catDeleteController.php. The manipulation of the argument record leads to sql injection. The attac
- 9.8 Critical severity
Simple Admin Panel: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in code-projects Simple Admin Panel 1.0. This vulnerability affects unknown code of the file editItemForm.php. The manipulation of the argument record leads to sql injection. The attack can be initiated remotely
- 8.8 High severity
Simple Admin Panel: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in code-projects Simple Admin Panel 1.0. This affects an unknown part of the file updateItemController.php. The manipulation of the argument p_desk leads to sql injection. It is possible to initiate the att
- 8.8 High severity
Simple Admin Panel: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been classified as critical. Affected is an unknown function of the file /addCatController.php. The manipulation of the argument size leads to sql injection. It is possible to launch the
- 8.8 High severity
Student Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in code-projects Student Management System 1.0.00 and classified as critical. This vulnerability affects unknown code of the file /addCatController.php. The manipulation of the argument size leads to sql injection. The attack can
- 8.8 High severity
Simple Admin Panel: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in code-projects Simple Admin Panel 1.0. This affects an unknown part. The manipulation of the argument c_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in 1000 Projects Attendance Tracking Management System 1.0. Affected by this issue is some unknown functionality of the file /faculty/check_faculty_login.php. The manipulation of the argument fa
- 8.8 High severity
Project Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Codezips Project Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/forms/advanced.php. The manipulation of the argument name leads to sql injection. The atta
- 9.8 Critical severity
FoxCMS: Improper Control of Generation of Code
A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injectio
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/course_action.php. The manipulation of the argument course_code leads to sql inje
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/faculty_action.php. The manipulation of the argument faculty_course_id leads to s
- 9.8 Critical severity
TreasureHunt: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function console_log of the file TreasureHunt/checkflag.php. The manipulation of the argument problema leads to sql
- 9.8 Critical severity
TreasureHunt: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to
- 8.8 High severity
Online Exam Mastering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in code-projects Online Exam Mastering System 1.0. Affected is an unknown function of the file /account.php?q=quiz&step=2. The manipulation of the argument eid leads to sql injection. It is possible to laun
- 8.8 High severity
Online Exam Mastering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects Online Exam Mastering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /update.php?q=quiz&step=2. The manipulation of the argument eid leads to sql injection. The attac
- 9.8 Critical severity
E-Commerce Website: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched
- 9.8 Critical severity
E-Commerce Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0. This affects an unknown part of the file /admin/editorder.php. The manipulation of the argument dstatus/quantity/ddate leads to sql injection. It is possible to initi
- 9.8 Critical severity
E-Commerce Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file newadmin.php. The manipulation of the argument email leads to sql injection. The attack can be launched rem
- 9.8 Critical severity
E-Commerce Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips E-Commerce Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file signin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. Th
- 9.8 Critical severity
PbootCMS: Improper Control of Generation of Code
A vulnerability was found in PbootCMS up to 3.2.3. It has been classified as critical. This affects an unknown part of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to code injection. It is possible to initiate t
- 9.8 Critical severity
Technical Discussion Forum: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Codezips Technical Discussion Forum 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file signinpost.php. The manipulation of the argument username leads to sql injection. The attack may b
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in 1000 Projects Attendance Tracking Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/check_student_login.php. The manipulation of the argument stud
- 8.8 High severity
Vehicle Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file sendmail.php. The manipulation of the argument id leads to sql injection. The atta
- 9.8 Critical severity
Vehicle Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been classified as critical. Affected is an unknown function of the file editbill.php. The manipulation of the argument id leads to sql injection. It is possible to launch the atta
- 9.8 Critical severity
Attendance Tracking Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in 1000 Projects Attendance Tracking Management System 1.0. Affected is an unknown function of the file /admin/check_admin_login.php. The manipulation of the argument admin_user_name leads to sql injection.
- 8.8 High severity
Farmacia: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Farmacia 1.0. It has been rated as critical. This issue affects some unknown processing of the file /visualizar-usuario.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remo
- 9.8 Critical severity
Online Class and Exam Scheduling System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teacher_save.php. The manipulation of the argument salut leads to sql injection