CWE-75: Special Element Injection
The product does not adequately filter user-controlled input for special elements with control implications.
Also known as Failure to Sanitize Special Elements into a Different Plane.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- langroid Langroid: handle_message() executes user-supplied tool JSON without sender verification 8.1 High
- apache apisix Apache APISIX: forward auth plugin allows header injection 9.1 Critical
- iguazio nuclio Nuclio Shell Runtime Command Injection Leading to Privilege Escalation 8.9 High
- vapor leaf-kit, leafkit +1 more Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster 6.1 Medium
- airc mynet Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before... 9.6 Critical
- python-ldap python-ldap has sanitization bypass in ldap.filter.escape_filter_chars 5.5 Medium
- apache software foundation airflow providers snowflake, apache apache-airflow-providers-snowflake +1 more Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator 9.8 Critical
- apache ambari Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts 8.8 High
- lunary, lunary-ai lunary-ai/lunary +1 more Email Injection Vulnerability in lunary-ai/lunary 5.3 Medium
- codepeople calculated fields form Calculated Fields Form <= 5.2.45 - HTML Injection 5.3 Medium
- woodwing elvis dam elvis dam WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution ... 8.8 High
- surrealdb SurrealDB before 1.5.5 Query Injection via RPC API 8.7 High
- gl-inet a1300 firmware, ap1300 firmware, ar300m16 firmware +46 more +48 more GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000... 9.8 Critical
- zkteco zktime web An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an... 7.5 High
- splunk, splunk cloud platform, enterprise +2 more Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint 4.6 Medium
- splunk, splunk cloud platform, enterprise +2 more Command Injection using External Lookups 8.0 High
- skycaiji An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST... 9.8 Critical
- mitel 6869i sip firmware, rev00 6868i , rev03 6869i +2 more On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform... 8.8 High
- mocodo online, mocado +1 more Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. 9.8 Critical
- totolink ex200 firmware In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without... 6.5 Medium
- totolink ex200 firmware TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE)... 8.8 High
- totolink ex200 firmware TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS)... 6.5 Medium
- wintercms winter Winter CMS Server-Side Template Injection (SSTI) vulnerability 7.2 High
- psf black Black vulnerable to Regular Expression Denial of Service (ReDoS) 5.3 Medium
- arcserve unified data protection, udp +1 more Unauthenticated DoS in Arcserve Unified Data Protection 7.5 High
- google android In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execu… 6.7 Medium
- apple macos An injection issue was addressed with improved input validation. This issue is fixed in macOS... 7.8 High
- apple macos An injection issue was addressed with improved input validation. This issue is fixed in macOS... 7.8 High
- cmsmadesimple cms made simple A remote code execution vulnerability has been identified in the User Defined Tags module of CMS... 7.2 High
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.7 +10 more +12 more Keycloak: reflected xss via wildcard in oidc redirect_uri 4.6 Medium
- apache axis Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService 9.8 Critical
- phpmyfaq, thorsten thorsten/phpmyfaq +1 more Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq 8.9 High
- haxx curl, fedoraproject fedora, netapp active iq unified manager +9 more +11 more A vulnerability in input validation exists in curl <8.0 during communication using the TELNET... 8.8 High
- ui er-10x firmware, er-12 firmware, er-12p firmware +7 more +9 more A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security... 8.8 High
- radare radare2, radareorg radareorg/radare2 +1 more Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2 8.6 High
- tradr-project tf remapper ** DISPUTED ** The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows... 8.1 High
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 more Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffweb 6.6 Medium
- octoprint, octoprint octoprint/octoprint +1 more Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint 6.0 Medium
- siemens desigo pxc4, desigo pxc5, desigo pxc4 firmware +1 more +3 more A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo... 9.0 Critical
- tiny plupload Arbitrary File Upload 4.2 Medium
- cachethq cachet, catchethq catchet +1 more Configuration leak 8.8 High
- jupyter notebook Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook 10.0 Critical
- jupyter jupyterlab JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> 7.4 High
- rocket.chat A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that... 9.8 Critical
- rocket.chat A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that... 9.8 Critical
- revive-adserver revive adserver Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't... 3.1 Low