Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
sofa-hessian: Improper Neutralization of Special Elements in Output Used by a Downstream Component
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain tha
- 9.9 Critical severity
camaleon-cms: Improper Limitation of a Pathname to a Restricted Directory
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the we
- 8.8 High severity
wolfCrypt: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges
- 8.8 High severity
wolfCrypt: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges vi
- 7.8 High severity
RestSharp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The same applies to `RestRequest.AddOrUpdateHeader` and `RestClient.AddDefaultHeader`. The way HTTP head
- 9.1 Critical severity
arrow_cms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, le
- 9.8 Critical severity
openedx-translations: Improper Neutralization of Special Elements in Output Used by a Downstream Component
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform rep
- 10.0 Critical severity
flatpak: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whic
- 8.8 High severity
xwiki-pro-macros: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerab
- 9.8 Critical severity
gl-mt2500: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permission
- 9.6 Critical severity
monkeytype: Improper Control of Generation of Code
Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comme
- 9.8 Critical severity
School Log Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. This affects an unknown part of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The e
- 9.8 Critical severity
School Log Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/print_barcode.php. The manipulation of the argument tbl results in sql injection. It is possible to
- 9.8 Critical severity
School Log Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection.
- 8.8 High severity
Anki: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.
- 9.8 Critical severity
LimeSurvey: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General S
- 8.8 High severity
woodpecker: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow.
- 8.8 High severity
woodpecker: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow.
- 8.3 High severity
haven: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrat
- 7.2 High severity
sliver: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver version 1.6.0 (prerelease) is vulnerable to RCE on the teamserver by a low-privileged "operator" us
- 7.2 High severity
Cisco Secure Email: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device. This vulnerability is due to insufficient input validation
- 7.3 High severity
dbt-core: Improper Control of Generation of Code
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core component
- 9.8 Critical severity
Apache Wicket: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix t
- 8.8 High severity
playSMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=feature_firewall&op=firewall_list of the component Template Handler. The manipulatio
- 10.0 Critical severity
CocoaPods: Improper Neutralization of Special Elements in Output Used by a Downstream Component
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX rec
- 7.5 High severity
Flowise: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName`
- 9.8 Critical severity
Melty Blood Actress Again Current Code: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code on a client's machine via a crafted packet on TCP port 46318.
- 9.8 Critical severity
datagear: Improper Neutralization of Special Elements in Output Used by a Downstream Component
DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface.
- 9.1 Critical severity
EmailGPT: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standa
- 9.8 Critical severity
pisay_online_e-learning_system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 allows attackers to execute arbitrary code via uploading a crafted file.
- 9.6 Critical severity
PWAsForFirefox: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entrie
- 8.1 High severity
vtiger_crm: Improper Neutralization of Special Elements in Output Used by a Downstream Component
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).
- 8.0 High severity
iTop: Improper Neutralization of Formula Elements in a CSV File
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, u
- 8.8 High severity
News Portal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. The attack can be initiated re
- 9.8 Critical severity
xxl-job: Deserialization of Untrusted Data
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injecti
- 7.4 High severity
swift-prometheus: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query par
- 7.5 High severity
astro-shield: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external
- 9.0 Critical severity
parse-server: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code
- 8.1 High severity
turbo_boost-commands: Improper Neutralization of Special Elements in Output Used by a Downstream Component
turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing
- 9.1 Critical severity
peering-manager: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Pee