CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements in Output Used by a Downstream Component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- gl.inet gl-mt3000GL.iNet GL-MT3000 modem.so glc remove_profile command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection9.3 Critical
- gl-inet gl-mt3000GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection9.3 Critical
- gl.inet gl-mt3000GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection8.7 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection8.6 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection8.7 High
- oscommerceosCommerce Email Template Configuration EmailController.php EmailController sql injection5.1 Medium
- kyndryl-open-source hashi-vault-jshashi-vault-js has a path traversal and query parameter injection8.7 High
- gitlabImproper Neutralization of Input Used for LLM Prompting in GitLab4.3 Medium
- kube-logging logging-operatorLogging operator has Fluentd configuration injection that allows remote code execution9.9 Critical
- nodejs undiciundici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields4.8 Medium
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped enum string values8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template8.3 High
- blackberry uem, unified endpoint manager +1 moreImproper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM5.9 Medium
- gitpython-developers gitpythonGitPython before 3.1.53 Config Injection via Submodule Names7.3 High
- codeastro online classroomCodeAstro Online Classroom loginlinkadmin.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System prescription.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection6.9 Medium
- zsadmin2025 zs-adminzsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +17 more +19 moreD-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionorder.php sql injection5.3 Medium
- beijing shenzhou shihan technology multimedia integrated business display systemBeijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionorderreport.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_subject.php sql injection6.9 Medium
- zevorn rt-clawzevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_room1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_rooma.php sql injection6.9 Medium
- liumengxuan04 minicodeLiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection2.3 Low
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionrecord.php sql injection5.3 Medium
github.com/oapi-codegen/oapi-codegenGo,github.com/oapi-codegen/oapi-codegen/v2Go +1 moreoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code0.0 None- code-projects hospital bed management systemcode-projects Hospital Bed Management System Login Form sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionorderdetail.php sql injection5.3 Medium
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION9.3 Critical
- bunkerity bunkerwebbunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb6.1 Medium
- h3c secpath f1000-c8300H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection6.9 Medium
github.com/almeidapaulopt/tsdproxyGoTsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services8.5 High- sourcecodester simple and nice shopping cart scriptSourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection6.9 Medium
- code-projects online job portalcode-projects Online Job Portal DeleteUser.php sql injection6.9 Medium
- code-projects online job portalcode-projects Online Job Portal EditUser.php sql injection6.9 Medium
- itsourcecode electronic judging systemitsourcecode Electronic Judging System add_judges.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_exam2.php sql injection6.9 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System POST accept.php sql injection5.3 Medium
- Show moreLoading…