Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.8 High severity
macOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
- 7.8 High severity
macOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
- 8.8 High severity
PDF Invoices and Packing Slips For WooCommerce: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticate
- 8.8 High severity
Kaspersky Security for Linux Mail Server 8: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions.
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Account/login.php. The manipulation of the argument txtusername/txtphone leads to sql injec
- 9.8 Critical severity
hertzbeat: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used b
- 9.8 Critical severity
hertzbeat: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) scri
- 8.3 High severity
mantisbt: Improper Neutralization of Special Elements in Output Used by a Downstream Component
MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in
- 9.3 Critical severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkActio
- 9.8 Critical severity
Operational Decision Manager: Improper Neutralization of Special Elements in Output Used by a Downstream Component
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
- 8.1 High severity
glpi: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
- 8.8 High severity
Relic: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive information and escalate privileges via the cp_bbs_sig function.
- 7.5 High severity
Craft CMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selecte
- 8.8 High severity
nginx-ui: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-202
- 8.8 High severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid duri
- 9.8 Critical severity
X2000R: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452. Affected by this vulnerability is the function formMapDelDevice of the file /boafrm/formMapDelDevice. The manipulation of the argument macstr leads to command injection.
- 9.8 Critical severity
Atlassian Confluence Data Center and Server Template Injection Exploited
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions
- 7.6 High severity
A920: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used. The attacker must have physical USB access to the device in order to exploit this vulnerability.
- 7.8 High severity
POS terminals: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account privilege by shell injection starting with a specific word. The attacker must have shell access to the
- 9.8 Critical severity
SmartRobot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Intumit inc. SmartRobot's web framwork has a remote code execution vulnerability. An unauthorized remote attacker can exploit this vulnerability to execute arbitrary commands on the remote server.
- 7.5 High severity
DGX A100: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.
- 9.6 Critical severity
OX App Suite: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potential
- 9.6 Critical severity
Couchauth: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to
- 9.8 Critical severity
otclient: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remot
- 9.8 Critical severity
changed-files: Improper Neutralization of Special Elements used in a Command
tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak s
- 7.2 High severity
B.point: Improper Neutralization of Special Elements in Output Used by a Downstream Component
On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.
- 9.8 Critical severity
Restaurant Table Booking System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate/tdate leads to sql injection.
- 9.8 Critical severity
Faculty Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried
- 9.8 Critical severity
S210: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The explo
- 9.8 Critical severity
Informix JDBC: Improper Neutralization of Special Elements in Output Used by a Downstream Component
IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 259116.
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11
- 9.8 Critical severity
Gl-ar300m Firmware: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.
- 8.8 High severity
Alfresco Content Services: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to
- 9.8 Critical severity
Nipah Virus Testing Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. It
- 9.8 Critical severity
Mattermost: Improper Limitation of a Pathname to a Restricted Directory
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.
- 8.8 High severity
Confluence Data Center: Improper Neutralization of Special Elements in Output Used by a Downstream Component
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected inst
- 9.8 Critical severity
Five Star Restaurant Menu and Food Ordering: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.
- 9.8 Critical severity
Apache Derby: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the a
- 7.8 High severity
Grocy: Improper Neutralization of Special Elements in Output Used by a Downstream Component
HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags
- 9.1 Critical severity
RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.