CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements in Output Used by a Downstream Component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System deletemp.php sql injection5.3 Medium
- sourcecodester online book store systemSourceCodester Online Book Store System login.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System patviewprescription.php sql injection5.3 Medium
- No product listedDedeCMS Column Management search.php code injection5.1 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System dashboard.php sql injection5.3 Medium
- jinher oaJinher OA PlanGiveOut.aspx sql injection6.9 Medium
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection6.9 Medium
- pig-mesh pigpig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection5.3 Medium
- aojiaozero antarisAojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection5.3 Medium
- sergomanov smarthomeadatumsergomanov SmartHomeAdatum Login users.php sql injection6.9 Medium
- soniccloudorg sonic-agentSonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection6.9 Medium
- amtt hotel broadband operation systemAMTT Hotel Broadband Operation System switch_status.php sql injection5.1 Medium
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI add.php sql injection6.9 Medium
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI login.php sql injection6.9 Medium
- aster telecom azcallAster Telecom Azcall HTTP sis.php sql injection6.9 Medium
- trendnet tew-635brmTrendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection8.7 High
- icehrmIceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection5.3 Medium
- bahmni bahmni-coreBahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil7.1 High
- bahmni bahmnicoreBahmni bahmnicore Search Endpoint sql additionalParams sql injection5.3 Medium
- prestashop ps facetedsearchps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE10.0 Critical
- getgrav gravgrav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction5.1 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)4.7 Medium
- sourcecodester simple and nice shopping cart scriptSourceCodester Simple and Nice Shopping Cart Script login.php sql injection6.9 Medium
- code-projects interview management systemcode-projects Interview Management System View.php sql injection6.9 Medium
- code-projects online food order systemcode-projects Online Food Order System edit_food_items.php sql injection6.9 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System index.php sql injection6.9 Medium
- linuxfoundation nats-serverNATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection7.1 High
- bentoml openllmbentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection4.8 Medium
- kedacore kedaKEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping5.9 Medium
- langroidLangroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-258799.2 Critical
- coderCoder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`8.3 High
- langroidLangroid: handle_message() executes user-supplied tool JSON without sender verification8.1 High
- kozea weasyprintWeasyPrint: CSS Injection via Presentational Hints6.5 Medium
- apache camel, apache software foundation camel salesforce +1 moreApache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour5.3 Medium
- apache camelApache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to…5.3 Medium
- apache camelApache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC m…6.5 Medium
- apache camelApache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query paramete…9.1 Critical
- codeastro ecommerce websiteCodeAstro Ecommerce Website my_account.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System visitor-entry.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System edit-apartment.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System report.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System action-visitor.php sql injection5.3 Medium
- yt-dlpyt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output7.5 High
- itsourcecode hospital management systemitsourcecode Hospital Management System paymentdischarge.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System payment.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_course1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_exam1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_room.php sql injection6.9 Medium
- code-projects real state servicescode-projects Real State Services pay.php sql injection6.9 Medium
- code-projects real state servicescode-projects Real State Services builderHome.php sql injection6.9 Medium
- Show moreLoading…