CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,095 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 48 of 102

CVE-2025-15420HIGHCVSS 7.3EG 7.3
2026-01-02
A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The…
CVE-2025-15421HIGHCVSS 7.3EG 7.3
2026-01-02
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. T…
CVE-2025-15424HIGHCVSS 7.3EG 7.3
2026-01-02
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql in…
CVE-2025-15425HIGHCVSS 7.3EG 7.3
2026-01-02
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql inj…
CVE-2025-15434HIGHCVSS 7.3EG 7.3
2026-01-02
A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results in sql injection. It is possible to launch the attack remotely. The exploit is …
CVE-2025-15435HIGHCVSS 7.3EG 7.3
2026-01-02
A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. This manipulation of the argument Report causes sql injection. The attack can be initiated remotel…
CVE-2025-15436HIGHCVSS 7.3EG 7.3
2026-01-02
A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched remot…
CVE-2025-15439MEDIUMCVSS 6.3EG 6.3
2026-01-02
A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_aggregate.go of the component Aggregate API. The manipulation of the argument column/group/order le…
CVE-2025-1544MEDIUMCVSS 6.3EG 6.3
2025-02-21
A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possibl…
CVE-2025-15442MEDIUMCVSS 4.7EG 4.7
2026-01-04
A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of the argument cate_id causes sql injection. The attack may be initiated remotely. T…
CVE-2025-15443MEDIUMCVSS 4.7EG 4.7
2026-01-04
A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation of the argument cate_id leads to sql injection. The attack may be launched remo…
CVE-2025-15450MEDIUMCVSS 6.3EG 6.3
2026-01-05
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderHosNum of the file /ssm_pro/orderHos/. Such manipulation of the argument hospital…
CVE-2025-15492MEDIUMCVSS 6.3EG 6.3
2026-01-09
A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMapper.xml. Performing a manipulation of the argument searchWord results in sql inj…
CVE-2025-15493MEDIUMCVSS 6.3EG 6.3
2026-01-09
A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/ReposAuthMapper.xml. Executing a manipulation of the argument searchWord can lead to sql injection. I…
CVE-2025-15494MEDIUMCVSS 6.3EG 6.3
2026-01-09
A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipulation of the argument Username leads to sql injection. The attack can be initiat…
CVE-2025-15496MEDIUMCVSS 6.3EG 6.3
2026-01-09
A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit ha…
CVE-2025-1576MEDIUMCVSS 6.3EG 6.3
2025-02-23
A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax_state.php. The manipulation of the argument StateNam…
CVE-2025-1578MEDIUMCVSS 6.3EG 6.3
2025-02-23
A vulnerability, which was classified as critical, was found in PHPGurukul/Campcodes Online Shopping Portal 2.1. This affects an unknown part of the file /search-result.php. The manipulation of the argument Product leads to sql injection. …
CVE-2025-1580MEDIUMCVSS 6.3EG 6.3
2025-02-23
A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument searchdata leads…
CVE-2025-1581MEDIUMCVSS 6.3EG 6.3
2025-02-23
A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /book-nurse.php?bookid=1. The manipulation of the argument con…
CVE-2025-1582MEDIUMCVSS 6.3EG 6.3
2025-02-23
A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/all-request.php. The manipulation of the argument viewid leads t…
CVE-2025-1583MEDIUMCVSS 6.3EG 6.3
2025-02-23
A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-report-details.php. The manipulation of the argument searchinput leads to sql inject…
CVE-2025-1596HIGHCVSS 7.3EG 7.3
2025-02-23
A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the file /fpassword.php. The manipulation of the argument email leads to sql injectio…
CVE-2025-1611MEDIUMCVSS 4.7EG 4.7
2025-02-24
A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. The manipulation leads to injection. It i…
CVE-2025-1640HIGHCVSS 7.3EG 7.3
2025-02-25
A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParamete…
CVE-2025-1641HIGHCVSS 7.3EG 7.3
2025-02-25
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&local…
CVE-2025-1691HIGHCVSS 7.6EG 7.6
2025-02-27
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user inter…
CVE-2025-1797MEDIUMCVSS 6.3EG 6.3
2025-03-01
A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System up to 20250217. Affected by this issue is some unknown functionality of the fil…
CVE-2025-1800MEDIUMCVSS 6.3EG 6.3
2025-03-01
A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view/vpn/sxh_vpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The mani…
CVE-2025-1807LOWCVSS 3.5EG 3.5
2025-03-02
A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of the component Edit Manual Reply Handler. The manipulation of the argument Title…
CVE-2025-1808HIGHCVSS 7.3EG 7.3
2025-03-02
A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login&tipo=1 of the component Login Endpoint. The manipulation of the argument txtUsuar…
CVE-2025-1809HIGHCVSS 7.3EG 7.3
2025-03-02
A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 of the component Login…
CVE-2025-1811HIGHCVSS 7.3EG 7.3
2025-03-02
A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.aspx of the component Login Endpoint. The manipulation of…
CVE-2025-1812MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability classified as critical has been found in zj1983 zz up to 2024-08. Affected is the function GetUserOrg of the file com/futvan/z/framework/core/SuperZ.java. The manipulation of the argument userId leads to sql injection. It i…
CVE-2025-1820MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability has been found in zj1983 zz up to 2024-8 and classified as critical. Affected by this vulnerability is the function getOaWid of the file src/main/java/com/futvan/z/system/zworkflow/ZworkflowAction.java. The manipulation of …
CVE-2025-1821MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability was found in zj1983 zz up to 2024-8 and classified as critical. Affected by this issue is the function getUserOrgForUserId of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument…
CVE-2025-1831MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument user_id leads to sql i…
CVE-2025-1832MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is the function getUserList of the file src/main/java/com/futvan/z/system/zrole/ZroleAction.java. The manipulation of the argument r…
CVE-2025-1836MEDIUMCVSS 4.3EG 4.3
2025-03-02
A vulnerability was found in Incorta 2023.4.3. It has been classified as problematic. Affected is an unknown function of the component Edit Insight Handler. The manipulation of the argument Service Name leads to csv injection. It is possib…
CVE-2025-1840HIGHCVSS 7.3EG 7.3
2025-03-03
A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been rated as critical. Affected by this issue is some unknown functionality of the file /CDGServer3/workflowE/useractivate/updateorg.jsp. The manipulation of the argument flo…
CVE-2025-1841HIGHCVSS 7.3EG 7.3
2025-03-03
A vulnerability classified as critical has been found in ESAFENET CDG 5.6.3.154.205. This affects an unknown part of the file /CDGServer3/logManagement/ClientSortLog.jsp. The manipulation of the argument startDate/endDate leads to sql inje…
CVE-2025-1843MEDIUMCVSS 6.3EG 6.3
2025-03-03
A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql i…
CVE-2025-1844MEDIUMCVSS 6.3EG 6.3
2025-03-03
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. Affected is an unknown function of the file /CDGServer3/logManagement/backupLogDetail.jsp. The manipulation of the argument logTaskId lead…
CVE-2025-1845MEDIUMCVSS 6.3EG 6.3
2025-03-03
A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command inject…
CVE-2025-1850HIGHCVSS 7.3EG 7.3
2025-03-03
A vulnerability, which was classified as critical, has been found in Codezips College Management System 1.0. Affected by this issue is some unknown functionality of the file /university.php. The manipulation of the argument book_name leads…
CVE-2025-1854MEDIUMCVSS 6.3EG 6.3
2025-03-03
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/del_member.php. The manipulation of the argument name leads to sql injection.…
CVE-2025-1855MEDIUMCVSS 6.3EG 6.3
2025-03-03
A vulnerability was found in PHPGurukul Online Shopping Portal 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /product-details.php. The manipulation of the argument quality/pri…
CVE-2025-1856HIGHCVSS 7.3EG 7.3
2025-03-03
A vulnerability was found in Codezips Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/gen_invoice.php. The manipulation of the argument id leads to…
CVE-2025-1857HIGHCVSS 7.3EG 7.3
2025-03-03
A vulnerability classified as critical has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file /check_availability.php. The manipulation of the argument employeeid leads to sql injec…
CVE-2025-1858HIGHCVSS 7.3EG 7.3
2025-03-03
A vulnerability classified as critical was found in Codezips Online Shopping Website 1.0. This vulnerability affects unknown code of the file /success.php. The manipulation of the argument id leads to sql injection. The attack can be initi…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →