CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,788 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 12 of 116

CVE-2025-11404CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability was determined in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown part of the file /pages/save_tax.php. Executing manipulation of the argument percentage can lead to sql injection. It is possib…
CVE-2025-11403CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this issue is some unknown functionality of the file /del_booking.php. Performing manipulation of the argument ID results in sql injection. It i…
CVE-2025-11402CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The …
CVE-2025-11401CRITICALCVSS 9.8EG 9.8
2025-10-07
A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.php. This manipulation of the argument currcode causes sql injection. The attack is possible to be …
CVE-2025-11400CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /del_room.php. The manipulation of the argument ID results in sql injection. The attack can be executed remo…
CVE-2025-11399CRITICALCVSS 9.8EG 9.8
2025-10-07
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /pages/save_room.php. The manipulation of the argument floorno leads to sql injection. Remote …
CVE-2025-11397CRITICALCVSS 9.8EG 9.8
2025-10-07
A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /login.php. Performing manipulation of the argument email results in sql injection. The at…
CVE-2025-11396CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. Such manipulation of the argument Category leads to sql injection. The attack can be launched remote…
CVE-2025-11350CRITICALCVSS 9.8EG 9.8
2025-10-07
A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. The affected element is an unknown function of the file /bwdates-reports-details.php. The manipulation of the argument fromdate/todate results…
CVE-2025-11349CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /search-visitor.php. The manipulation of the argument searchdata leads to sql injection. The attack may…
CVE-2025-11348CRITICALCVSS 9.8EG 9.8
2025-10-07
A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /index.php. Executing a manipulation of the argument Username can lead to sql injection. The…
CVE-2025-11342CRITICALCVSS 9.8EG 9.8
2025-10-06
A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing manipulation of the argument coursecode can lead to sql injection. The attack ca…
CVE-2025-11334CRITICALCVSS 9.8EG 9.8
2025-10-06
A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. Affected is an unknown function of the file /visitor-detail.php. The manipulation of the argument editid results in sql injection. The attack …
CVE-2025-11329CRITICALCVSS 9.8EG 9.8
2025-10-06
A flaw has been found in code-projects Online Course Registration 1.0. Impacted is an unknown function of the file /admin/manage-students.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely.…
CVE-2025-11317CRITICALCVSS 9.8EG 9.8
2025-10-06
A vulnerability was identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findRolePage of the file findSingConfigPage.do. The manipulation of …
CVE-2025-11316CRITICALCVSS 9.8EG 9.8
2025-10-06
A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of the file findCategoryPage.do. Execu…
CVE-2025-11315CRITICALCVSS 9.8EG 9.8
2025-10-06
A vulnerability was found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this vulnerability is the function findUserPage of the file findUserPage.do. Performing…
CVE-2025-11314CRITICALCVSS 9.8EG 9.8
2025-10-06
A vulnerability has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected is the function findRolePage of the file findSingConfigPage.do. Such manipulation of …
CVE-2025-11313CRITICALCVSS 9.8EG 9.8
2025-10-06
A flaw has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This impacts the function findRolePage of the file findRolePage.do. This manipulation of the argument s…
CVE-2025-11312CRITICALCVSS 9.8EG 9.8
2025-10-06
A vulnerability was detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findModulePage.do. The manipulation of the …
CVE-2025-11311CRITICALCVSS 9.8EG 9.8
2025-10-06
A security vulnerability has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenantPage of the file findTenantPage.do.…
CVE-2025-11310CRITICALCVSS 9.8EG 9.8
2025-10-06
A weakness has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of the file findFileServerPage.do. Exe…
CVE-2025-11309CRITICALCVSS 9.8EG 9.8
2025-10-05
A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Impacted is the function doFilter of the file findDeptPage.do. Performing manipulation of…
CVE-2025-11118CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.php. Such manipulation of the argument staffId leads to sql injection. The attack may be performed f…
CVE-2025-11116CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argument faculty results in sql injection. The attack can be executed remotely. The ex…
CVE-2025-11115CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the file /addtime.php. The manipulation of the argument starttime/endtime leads to sql injection. Remote …
CVE-2025-11111CRITICALCVSS 9.8EG 9.8
2025-09-28
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidates_edit.php. This manipulation of the argument ID causes sql injection. The attack can be…
CVE-2025-11110CRITICALCVSS 9.8EG 9.8
2025-09-28
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/school_year.php. The manipulation of the argument school_year results in sql injection. …
CVE-2025-11109CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/us_edit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is …
CVE-2025-11108CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability was determined in code-projects Simple Scheduling System 1.0. Impacted is an unknown function of the file /schedulingsystem/addroom.php. Executing manipulation of the argument room can lead to sql injection. The attack may …
CVE-2025-11107CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability was found in code-projects Simple Scheduling System 1.0. This issue affects some unknown processing of the file /schedulingsystem/addcourse.php. Performing manipulation of the argument corcode results in sql injection. The …
CVE-2025-11106CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulingsystem/addfaculty.php. Such manipulation of the argument falname leads to sql injection. The attac…
CVE-2025-11105CRITICALCVSS 9.8EG 9.8
2025-09-28
A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulation of the argument subcode causes sql injection. Remote exploitation of the atta…
CVE-2025-11102CRITICALCVSS 9.8EG 9.8
2025-09-28
A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can …
CVE-2025-11101CRITICALCVSS 9.8EG 9.8
2025-09-28
A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php?view=edit. Performing manipulation of the argument ID results in sql injection.…
CVE-2025-11094CRITICALCVSS 9.8EG 9.8
2025-09-28
A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_product_details.php. Such manipulation of the argument prod_id leads to sql injection. The attack may…
CVE-2025-11089CRITICALCVSS 9.8EG 9.8
2025-09-28
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Profilers/PriProfile/COUNT3s4.php. Executing manipulation of the argument cbranch …
CVE-2025-11077CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was determined in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/add_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can b…
CVE-2025-11076CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was found in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_teacher.php. Performing manipulation of the argument department results in sql injection. Remote exploit…
CVE-2025-11075CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability has been found in Campcodes Online Learning Management System 1.0. This affects an unknown function of the file /admin/de_activate.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched…
CVE-2025-11074CRITICALCVSS 9.8EG 9.8
2025-09-27
A flaw has been found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument username/password causes sql injection. The attack may be initiated…
CVE-2025-11070CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote.…
CVE-2025-11066CRITICALCVSS 9.8EG 9.8
2025-09-27
A flaw has been found in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/bidlist.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remo…
CVE-2025-11064CRITICALCVSS 9.8EG 9.8
2025-09-27
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Impacted is an unknown function of the file /admin/teachers.php. The manipulation of the argument department results in sql injection. It is possible t…
CVE-2025-11063CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was identified in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /admin/edit_department.php. The manipulation of the argument d leads to sql injection. It is possible…
CVE-2025-11062CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was determined in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/save_student.php. Executing manipulation of the argument class_id can lead to sql injection. The …
CVE-2025-11061CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was found in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/edit_student.php. Performing manipulation of the argument cys results in sql injection. The attack is possible to…
CVE-2025-11057CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/print_inv.php. Such manipulation of the argument ID leads to sql injection. The …
CVE-2025-11056CRITICALCVSS 9.8EG 9.8
2025-09-27
A flaw has been found in ProjectsAndPrograms School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file owner_panel/fetch-data/select-students.php. This manipulation of the argument select causes s…
CVE-2025-11055CRITICALCVSS 9.8EG 9.8
2025-09-27
A vulnerability was detected in SourceCodester Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/updateaddress.php. The manipulation of the argument address results in sql injection. The attack may be …

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →