CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements in Output Used by a Downstream Component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- altitude communication serverImproper Neutralization in Altitude Communication Server5.1 Medium
- code-projects online examination systemcode-projects Online Examination System Login Page index.php sql injection6.9 Medium
- d-link dcs700l, dlink dcs-700l firmware +1 moreD-Link DCS700l Web Form setDayNightMode command injection5.1 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection5.3 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request port_validate portValidate command injection5.3 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injection6.9 Medium
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection5.3 Medium
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setWanCfg command injection5.3 Medium
- horillaHorilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover8.8 High
- getgrist grist-corepyodide sandbox option is insecure9.1 Critical
- python software foundation cpythonwsgiref.headers.Headers allows header newline injection5.9 Medium
- tosei online store management system ネット店舗管理システム, tosei-corporation online store management system +1 moreTosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter user_popedom.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter select.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter save_folder.jsp sql injection6.9 Medium
- itsourcecode school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- itsourcecode directory management systemPHPGurukul Directory Management System Search index.php sql injection6.9 Medium
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System order_online.php sql injection6.9 Medium
- janobe e-learning systemSourceCodester E-Learning System Lesson index.php cross site scripting5.3 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection5.3 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection5.3 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter folder.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter edit_folder.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter save_catalog.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter worksadd_plan.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter worksadd.jsp sql injection6.9 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_wifidog_settings sub_412E7C command injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_report.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_mod.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_info.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter del_workplan.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter del_work.jsp sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System delete_activity.php sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System add_activity.php sql injection5.3 Medium
- easycmsEasyCMS UserAction.class.php sql injection6.9 Medium
- kalcaddle kodboxkalcaddle kodbox Compression zip command injection5.3 Medium
- bastillion-io bastillionbastillion-io Bastillion System Management SystemKtrl.java command injection5.1 Medium
- bastillion-io bastillionbastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injection5.1 Medium
- feminer wms, warehouse management system +1 moreFeMiner wms chkuser.php sql injection6.9 Medium
- risesoft-y9 digital-infrastructurerisesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection6.9 Medium
activejobRubyGemsActive Job - Object injection security vulnerability6.6 Mediumalgolia/algoliasearch-magento-2PackagistAlgolia Search & Discovery for Magento 2 Has Untrusted Data Handling6.9 Medium- anysphere cursorCursor has a Terminal Tool Allowlist Bypass via Environment Variables7.2 High
- apache camel, apache software foundation camel neo4j +1 moreApache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component5.3 Medium
- vaadin, vaadin rich-text-editor, vaadin-core +1 more +3 moreStored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed5.1 Medium
- anchore quillQuill 2.0.3 - Lack of data validation in HTML export allowing XSS5.1 Medium
- enhancesoft osticketosTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read8.7 High
- code-projects online music sitecode-projects Online Music Site AdminUpdateUser.php sql injection6.9 Medium
- code-projects online music sitecode-projects Online Music Site AdminAddUser.php sql injection6.9 Medium
- carmelo intern membership management systemcode-projects Intern Membership Management System delete_activity.php sql injection5.1 Medium
- Show moreLoading…