CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,788 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 13 of 116

CVE-2025-11053CRITICALCVSS 9.8EG 9.8
2025-09-27
A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the argument email can lead to sql injection. The attack can be launched remotely. The…
CVE-2025-11052CRITICALCVSS 9.8EG 9.8
2025-09-27
A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. The impacted element is an unknown function of the file /Profilers/PriProfile/COUNT3s5.php. Performing manipulation of the argument csslc results in sql injecti…
CVE-2025-11040CRITICALCVSS 9.8EG 9.8
2025-09-26
A vulnerability was detected in code-projects Hostel Management System 1.0. Affected by this issue is some unknown functionality of the file /justines/admin/mod_users/index.php?view=view. The manipulation of the argument ID results in sql …
CVE-2025-11039CRITICALCVSS 9.8EG 9.8
2025-09-26
A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us_edit1.php. The manipulation of the argument ID leads to sql i…
CVE-2025-11037CRITICALCVSS 9.8EG 9.8
2025-09-26
A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/admin_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack ma…
CVE-2025-11036CRITICALCVSS 9.8EG 9.8
2025-09-26
A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/admin_account_update.php. Such manipulation of the argument user_id leads to sql injection. The attack can be launc…
CVE-2025-11033CRITICALCVSS 9.8EG 9.8
2025-09-26
A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Impacted is an unknown function of the file /Profilers/PriProfile/COUNT3s7.php. The manipulation of the argument cbe leads to sq…
CVE-2025-11032CRITICALCVSS 9.8EG 9.8
2025-09-26
A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This issue affects some unknown processing of the file /Profilers/PriProfile/COUNT3s6.php. Executing manipulation of the argument CPU can…
CVE-2025-10808CRITICALCVSS 9.8EG 9.8
2025-09-22
A weakness has been identified in Campcodes Farm Management System 1.0. Impacted is an unknown function of the file /uploadProduct.php. This manipulation of the argument Type causes sql injection. Remote exploitation of the attack is possi…
CVE-2025-10798CRITICALCVSS 9.8EG 9.8
2025-09-22
A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.php?view=view. Such manipulation of the argument ID leads to sql injection. The at…
CVE-2025-10796CRITICALCVSS 9.8EG 9.8
2025-09-22
A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin/login.php. The manipulation of the argument email results in sql injection. The attack can be laun…
CVE-2025-10624CRITICALCVSS 9.8EG 9.8
2025-09-17
A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument emailid results in sql injection. The attack can be initiated re…
CVE-2025-10623CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteuser.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch th…
CVE-2025-10621CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability was determined in SourceCodester Hotel Reservation System 1.0. The affected element is an unknown function of the file editroomimage.php. This manipulation of the argument ID causes sql injection. It is possible to initiate…
CVE-2025-10604CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. This affects an unknown part of the file /admin/edit_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. Th…
CVE-2025-10601CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Affected is an unknown function of the file /admin/index.php. Such manipulation of the argument email leads to sql injection. It is possible to launch the at…
CVE-2025-10599CRITICALCVSS 9.8EG 9.8
2025-09-17
A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument user_email results in s…
CVE-2025-10598CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This issue affects some unknown processing of the file /admin/search_product.php. Such manipulation of the argument group_id leads to sql injection. The…
CVE-2025-10597CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This vulnerability affects unknown code of the file /Profilers/PriProfile/COUNT2.php. This manipulation of the argument cname ca…
CVE-2025-10596CRITICALCVSS 9.8EG 9.8
2025-09-17
A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument usn results in sql injection. The attack can be launched remotely. The explo…
CVE-2025-10564CRITICALCVSS 9.8EG 9.8
2025-09-16
A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=delete_category. Performing manipulation of the argument ID results in sql injection. The attack is…
CVE-2025-10479CRITICALCVSS 9.8EG 9.8
2025-09-15
A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument stud_no results in sql injection. …
CVE-2025-58046CRITICALCVSS 9.8EG 9.8
2025-09-15
Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.datae…
CVE-2025-10405CRITICALCVSS 9.8EG 9.8
2025-09-14
A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Affected is an unknown function of the file /listbaptism.php. This manipulation of the argument bapt_id causes sql injection. It is possible to initi…
CVE-2025-56266CRITICALCVSS 9.8EG 9.8
2025-09-08
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.
CVE-2025-10097CRITICALCVSS 9.8EG 9.8
2025-09-08
A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible t…
CVE-2025-10079CRITICALCVSS 9.8EG 9.8
2025-09-08
A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be executed …
CVE-2025-10068CRITICALCVSS 9.8EG 9.8
2025-09-07
A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch…
CVE-2025-9935CRITICALCVSS 9.8EG 9.8
2025-09-04
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be …
CVE-2025-9934CRITICALCVSS 9.8EG 9.8
2025-09-04
A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument pid results in command injection. Remote exploitation of th…
CVE-2025-9933CRITICALCVSS 9.8EG 9.8
2025-09-04
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. Such manipulation of the argument viewid leads to sql injectio…
CVE-2025-9932CRITICALCVSS 9.8EG 9.8
2025-09-04
A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-image.php. This manipulation of the argument lid causes sql injection. The attac…
CVE-2025-9930CRITICALCVSS 9.8EG 9.8
2025-09-04
A security vulnerability has been detected in 1000projects Beauty Parlour Management System 1.0. This impacts an unknown function of the file /admin/contact-us.php. The manipulation of the argument mobnumber leads to sql injection. The att…
CVE-2025-9928CRITICALCVSS 9.8EG 9.8
2025-09-03
A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. Performing manipulation of the argument t1 results in sql injection. It is possib…
CVE-2025-9927CRITICALCVSS 9.8EG 9.8
2025-09-03
A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such manipulation of the argument t1 leads to sql injection. The attack may be performe…
CVE-2025-9926CRITICALCVSS 9.8EG 9.8
2025-09-03
A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulation of the argument t1 causes sql injection. The attack is possible to be carried…
CVE-2025-9925CRITICALCVSS 9.8EG 9.8
2025-09-03
A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation of the argument pid results in sql injection. The attack can be executed remotely…
CVE-2025-9924CRITICALCVSS 9.8EG 9.8
2025-09-03
A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulation of the argument t2 leads to sql injection. Remote exploitation of the attack i…
CVE-2025-9919CRITICALCVSS 9.8EG 9.8
2025-09-03
A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. …
CVE-2025-9840CRITICALCVSS 9.8EG 9.8
2025-09-02
A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/gametype.php. Executing manipulation of the argument code can lead to sql injection. The attack can…
CVE-2025-9839CRITICALCVSS 9.8EG 9.8
2025-09-02
A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/modules/course/index.php. Performing manipulation of the argument ID results in s…
CVE-2025-9838CRITICALCVSS 9.8EG 9.8
2025-09-02
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack…
CVE-2025-9837CRITICALCVSS 9.8EG 9.8
2025-09-02
A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the file /admin/modules/student/index.php. This manipulation of the argument studentId causes sql injec…
CVE-2025-9833CRITICALCVSS 9.8EG 9.8
2025-09-02
A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/login.php. Performing manipulation of the argument uname results in sql injecti…
CVE-2025-9832CRITICALCVSS 9.8EG 9.8
2025-09-02
A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register-router.php. Such manipulation of the argument phone leads to sql injection. The…
CVE-2025-9831CRITICALCVSS 9.8EG 9.8
2025-09-02
A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possibl…
CVE-2025-9830CRITICALCVSS 9.8EG 9.8
2025-09-02
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids[] results in sql injection. The at…
CVE-2025-9829CRITICALCVSS 9.8EG 9.8
2025-09-02
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The manipulation of the argument mobilenumber leads to sql injection. Remote exploitati…
CVE-2025-9814CRITICALCVSS 9.8EG 9.8
2025-09-02
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/contact-us.php. The manipulation of the argument mobnumber results in sql injection. It is possible …
CVE-2025-9811CRITICALCVSS 9.8EG 9.8
2025-09-02
A vulnerability was found in Campcodes Farm Management System 1.0. This affects an unknown part of the file /reviewInput.php. Performing manipulation of the argument rating results in sql injection. The attack is possible to be carried out…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →