CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements in Output Used by a Downstream Component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester hospitals patient records management systemSourceCodester Hospitals Patient Records Management System manage_history.php sql injection6.9 Medium
- sourcecodester hospitals patient records management systemSourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Slack Agent/Mattermost Agent escape output6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injection6.9 Medium
- sourcecodester hospitals patient records management systemSourceCodester Hospitals Patient Records Management System view_history.php sql injection5.3 Medium
- quantumnous new-apiQuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection5.3 Medium
- 546669204 vps-inventory-monitoring546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formWlbasic command injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formWlanM system command injection5.3 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler9.8 Critical
- cisco thousandeyes virtual appliance, thousandeyes enterprise agent +1 moreA vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could...4.7 Medium
- projectworlds hospital-management-system-in-phpprojectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection6.9 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formStaDrvSetup command injection5.3 Medium
- edimax br-6228ncEdimax BR-6228NC POST Request mp command injection5.3 Medium
- linlinjava litemalllinlinjava litemall Database Setting DbUtil.java load argument injection5.1 Medium
- linlinjava litemalllinlinjava litemall Admin Endpoint sql injection5.1 Medium
- linlinjava litemalllinlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection6.9 Medium
- kalcaddle kodboxkalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection5.3 Medium
- oinone pamirsOinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection6.9 Medium
- dataeaseDataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection5.1 Medium
- jasperfx martenMarten has an SQL injection vulnerability in its full-text search regConfig parameter9.8 Critical
- dkfz nnu-net, mic-dkfz nnunet +1 morennU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`7.2 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability5.4 Medium
- microsoft azure machine learningAzure Machine Learning Notebook Spoofing Vulnerability8.2 High
- microsoft visual studio codeGitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability8.8 High
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 portForward command injection5.3 Medium
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 singlePortForward sub_445E7C command injection5.3 Medium
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 formDMZ.cgi sub_445E7C command injection5.3 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 moreHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation5.3 Medium
- codeastro online catering ordering systemCodeAstro Online Catering Ordering System deleteorder.php sql injection5.3 Medium
- codelibs fesscodelibs Fess JSP File AdminDesignAction.java update code injection5.1 Medium
- aandrew-me tgptaandrew-me tgpt Update helper.go helper.Update command injection4.8 Medium
- honoHono: CSS Declaration Injection via Style Object Values in JSX SSR4.3 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields8.6 High
- zyx0814 filepresszyx0814 FilePress Shares Filelist API admin.php sql injection6.9 Medium
- codeastro leave management systemCodeAstro Leave Management System login.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping replymsg.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping message.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping wishlist.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping viewmsg.php sql injection6.9 Medium
- sourcecodester comment systemSourceCodester Comment System post_comment.php sql injection6.9 Medium
- code-projects simple chat systemcode-projects Simple Chat System sendMessage.php sql injection5.3 Medium
- No product listedJeecgBoot JSON Object loadTreeData sql injection5.3 Medium
- microsoft 365 copilot chat, 365 copilot's business chat +1 moreM365 Copilot Information Disclosure Vulnerability7.5 High
- code-projects feedback systemcode-projects Feedback System checklogin.php sql injection6.9 Medium
- codeastro online classroomCodeAstro Online Classroom askquery.php sql injection5.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection6.9 Medium
- honoHono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection4.7 Medium
- automattic mongooseMongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection7.5 High
- efm iptime c200EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection8.6 High
- Show moreLoading…