Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 8.8 High severity
Dolibarr ERP CRM: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
- 7.5 High severity
Langchain: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
- 7.5 High severity
Apache InLong: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it har
- 8.8 High severity
cachet: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e86
- 8.8 High severity
Thingsboard: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
- 7.8 High severity
Trellix Endpoint Security: Improper Control of Generation of Code
A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code.
- 8.8 High severity
Super Store Finder: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content.
- 7.5 High severity
Phpipam: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted
- 8.8 High severity
composer: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enab
- 8.8 High severity
Best Courier Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the argument id/s leads
- 9.0 Critical severity
matrix-hookshot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an at
- 7.8 High severity
Gnome-time Tracker: Improper Neutralization of Special Elements in Output Used by a Downstream Component
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
- 8.8 High severity
IRM Next Generation: Unrestricted Upload of File with Dangerous Type
A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerability requir
- 10.0 Critical severity
snapd: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators
- 7.7 High severity
RestrictedPython: Improper Neutralization of Special Elements in Output Used by a Downstream Component
RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from obje
- 9.8 Critical severity
eCommerce CMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. The impacted element is an unknown function of the file /search of the component GET Parameter Handler. Such manipulation of the argument filter[brandid] leads to sql injection. The attack may b
- 8.2 High severity
Mattermost: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.
- 7.2 High severity
cms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Althou
- 9.8 Critical severity
JimuReport: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remot
- 9.8 Critical severity
terramaster_operating_system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because p
- 9.8 Critical severity
Llamaindex: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
- 9.8 Critical severity
Langchain: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
- 9.8 Critical severity
Langchain: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
- 8.8 High severity
Checkmk: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users.
- 8.1 High severity
Wallet: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regar
- 9.1 Critical severity
Wallet: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation,
- 9.8 Critical severity
Zoom Desktop Client for Windows and Zoom VDI…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 9.8 Critical severity
Motocms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.
- 7.5 High severity
macOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5. An app may be able to bypass certain Privacy preferences.
- 8.8 High severity
OTRS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType h
- 8.8 High severity
grav: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass o
- 9.8 Critical severity
House Rental and Property Listing: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /index.php. The manipulation of the argument keywords/location leads
- 8.8 High severity
collection: Improper Neutralization of Special Elements in Output Used by a Downstream Component
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were cod
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in ot
- 7.8 High severity
sqlfluff: Improper Neutralization of Special Elements in Output Used by a Downstream Component
SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to b
- 9.8 Critical severity
opentsdb: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. Thi
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with prog
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow re
- 8.8 High severity
Openedge: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS b
- 9.8 Critical severity
WN579X3: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to laun