Failure to Sanitize Special Elements into a Different Plane
CWE-75
The product does not adequately filter user-controlled input for special elements with control implications.
We track 18 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.
Latest Failure to Sanitize Special Elements into a Different Plane vulnerabilities
- 8.8 High severity
surrealdb: Failure to Sanitize Special Elements into a Different Plane
SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query a
- 8.1 High severity
langroid: Failure to Sanitize Special Elements into a Different Plane
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered
- 9.1 Critical severity
Apache APISIX: Failure to Sanitize Special Elements into a Different Plane
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to vers
- 9.8 Critical severity
nuclio: Failure to Sanitize Special Elements into a Different Plane
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTT
- 9.6 Critical severity
Mynet: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
- 9.8 Critical severity
Apache Airflow Providers Snowflake: Failure to Sanitize Special Elements into a Different Plane
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were adde
- 8.8 High severity
woodwing_elvis_dam: Failure to Sanitize Special Elements into a Different Plane
WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality.
- 9.8 Critical severity
gl-mt2500: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permission
- 7.5 High severity
zktime_web: Failure to Sanitize Special Elements into a Different Plane
An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script to the csl/user component.
- 8.8 High severity
ex200_firmware: Failure to Sanitize Special Elements into a Different Plane
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.
- 7.8 High severity
macOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
- 7.8 High severity
macOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
- 7.2 High severity
cms_made_simple: Failure to Sanitize Special Elements into a Different Plane
A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result
- 9.8 Critical severity
** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not…
** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted i
- 8.8 High severity
https://github.com/curl/curl: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an a
- 8.8 High severity
Ubiquiti EdgeRouter(s) and USG(s): Improper Control of Generation of Code
A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to
- 8.1 High severity
tf_remapper: Failure to Sanitize Special Elements into a Different Plane
The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controll
- 9.0 Critical severity
Desigo PXC4: Failure to Sanitize Special Elements into a Different Plane
A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generat