CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements in Output Used by a Downstream Component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- dataease DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection 6.9 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 6.5 Medium
- openbmb internet of agents OpenBMB Internet of Agents Code Executor Tool code_executor.py execute_code code injection 6.9 Medium
- dvankooten mc4wp: mailchimp for wordpress MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag 4.8 Medium
- jhuckaby cronicle Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 9.0 Critical
- itsourcecode online book store itsourcecode Online Book Store admin_edit.php sql injection 6.9 Medium
- eosphoros-ai db-gpt eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection 6.9 Medium
- itsourcecode airline reservation system itsourcecode Airline Reservation System manage_booked.php sql injection 5.3 Medium
- edimax br-6208ac Edimax BR-6208AC mp command injection 10.0 Critical
- campcodes complete sales and inventory system with credit management Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection 6.9 Medium
- campcodes division regional athletic meet game result matrix system Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection 6.9 Medium
- krupalshah employeerecruitmentsystem krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection 6.9 Medium
- npc-worldwide npcpy NPC-Worldwide npcpy sft.py load_sft_model code injection 5.3 Medium
- ibm mq IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability 7.5 High
- No product listed funadmin Frontend List Endpoint index selectList sql injection 6.9 Medium
- projectsandprograms school-management-system sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection 6.9 Medium
- @effect platform, effect-ts effect +1 more Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie() 6.3 Medium
- mathurvishal cloudclassroom-php-project mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection 6.9 Medium
- ziroom zhome a0101 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 9.4 Critical
- typo3 extension "mail" Broken Access Control in extension "Mail" (mail) 5.3 Medium
- dayrui xunruicms dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection 6.9 Medium
- dayrui xunruicms dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection 6.9 Medium
- dayrui xunruicms dayrui XunRuiCMS Member View.php View sql injection 6.9 Medium
- mathurvishal cloudclassroom-php-project mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection 6.9 Medium
- beecue fastbee beecue FastBee Groovy Script Executor script code injection 5.1 Medium
- wavlink wl-wn530be1-a WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection 10.0 Critical
-
adminneo-org/adminneoPackagist AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE 6.9 Medium - 37954679 cak-filemanagement-system 37954679 cak-filemanagement-system save_student.php mysqli_query sql injection 6.9 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of... 6.8 Medium
- opnsense core OPNsense: Configuration line injection via multiple GUI text fields 8.1 High
- opnsense core OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields 6.0 Medium
- sswells formidable forms – contact form, survey, quiz, payment, calculator form & custom form builder Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter 8.8 High
- opencats OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) 7.2 High
- i18next i18next-http-backend i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string 3.7 Low
- juniper networks session smart conductor, session smart router +1 more Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting 5.8 Medium
- juniper networks session smart conductor, session smart router +1 more Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup 5.5 Medium
- unknown royal elementor addons Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes 5.3 Medium
- reduxjs redux-devtools reduxjs redux-devtools Remotedev Server evalAction code injection 4.8 Medium
- oretnom23 php-travel-agency-system oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection 6.9 Medium
- oretnom23 php-travel-agency-system oretnom23 php-travel-agency-system traceapplication.php sql injection 6.9 Medium
- oretnom23 php-travel-agency-system oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection 6.9 Medium
- oretnom23 php-travel-agency-system oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection 6.9 Medium
- itsourcecode online book store itsourcecode Online Book Store book.php sql injection 5.3 Medium
- totolink a950rg TOTOLINK A950RG firewall.so apmib_set command injection 9.4 Critical
- totolink a950rg TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection 9.4 Critical
- totolink a950rg TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection 9.4 Critical
- allenai allennlp AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection 5.3 Medium
- No product listed DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection 6.9 Medium
- oray pugongying x5 pro Oray Pugongying X5 Pro Dnsmasq crlf injection 9.3 Critical
- oray pugongying x5 pro Oray Pugongying X5 Pro L2TP Authentication crlf injection 9.4 Critical
- Show olderLoading…