CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,434 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 87 of 109

CVE-2026-12812LOWCVSS 3.5EG 3.5
2026-06-22
A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The manipulation leads to HTML injection. Remote exploitation of the attack is poss…
CVE-2026-12822HIGHCVSS 7.8EG 7.8
2026-06-22
A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was con…
CVE-2026-12888LOWCVSS 2.0EG 2.0
2026-06-22
An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. …
CVE-2026-1326HIGHCVSS 8.8EG 8.8
2026-01-22
A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname …
CVE-2026-1327HIGHCVSS 8.8EG 8.8
2026-01-22
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argumen…
CVE-2026-13485HIGHCVSS 7.3EG 7.3
2026-06-28
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a manipulation of the argument course_year_section results in sql injection. The attac…
CVE-2026-13486HIGHCVSS 7.3EG 7.3
2026-06-28
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Executing a manipulation of the argument course_year_section can lead to sql injectio…
CVE-2026-13487HIGHCVSS 7.3EG 7.3
2026-06-28
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulation of the argument sy leads to sql injection. The attack may be initiated remot…
CVE-2026-13488HIGHCVSS 7.3EG 7.3
2026-06-28
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality of the file /preview7.php. The manipulation of the argument course_year_section r…
CVE-2026-13495MEDIUMCVSS 4.7EG 4.7
2026-06-28
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminprofile.php. The manipulation of the argument loginid leads to sql injection. It is possible to initiate the a…
CVE-2026-13496MEDIUMCVSS 6.3EG 6.3
2026-06-28
A vulnerability was found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /ajaxmedicine.php. The manipulation of the argument medicineid results in sql injection. It is possible to la…
CVE-2026-13497MEDIUMCVSS 6.3EG 6.3
2026-06-28
A vulnerability was determined in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /appointment.php. This manipulation of the argument editid causes sql injection. The attack can be initi…
CVE-2026-13498HIGHCVSS 7.3EG 7.3
2026-06-28
A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the component POST Parameter Handler. Such manipulation of the argument email leads to sql…
CVE-2026-13500HIGHCVSS 7.3EG 7.3
2026-06-28
A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead t…
CVE-2026-13501MEDIUMCVSS 5.3EG 5.3
2026-06-28
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads …
CVE-2026-13520MEDIUMCVSS 6.3EG 6.3
2026-06-29
A vulnerability was determined in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /appointmentapproval.php of the component Appointment Handler. This manipulation of the argument editid causes sql i…
CVE-2026-13521HIGHCVSS 7.3EG 7.3
2026-06-29
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the file /preview5.php. Such manipulation of the argument course_year_section leads…
CVE-2026-13525MEDIUMCVSS 6.3EG 6.3
2026-06-29
A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee_model.php of the component Update_Earn_Leave Endpoint. The manipulation …
CVE-2026-13526HIGHCVSS 7.3EG 7.3
2026-06-29
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_class.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. Th…
CVE-2026-13527HIGHCVSS 7.3EG 7.3
2026-06-29
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /preview4.php. Such manipulation of the argument course_year_section leads to sql injection. Th…
CVE-2026-13529MEDIUMCVSS 5.6EG 5.6
2026-06-29
A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of the argument siteurl can lead to sql injection. The attack can be executed remotel…
CVE-2026-13530MEDIUMCVSS 6.3EG 6.3
2026-06-29
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql i…
CVE-2026-13531MEDIUMCVSS 6.3EG 6.3
2026-06-29
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /department.php. The manipulation of the argument editid results in sql injection. The attack may be performed …
CVE-2026-13532MEDIUMCVSS 6.3EG 6.3
2026-06-29
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /departmentDoctor.php. This manipulation of the argument deptid causes sql injection. It …
CVE-2026-13535MEDIUMCVSS 6.3EG 6.3
2026-06-29
A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/models/Employee_model.php of the component View Endpoint. Executing a manipulatio…
CVE-2026-13538MEDIUMCVSS 6.3EG 6.3
2026-06-29
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID…
CVE-2026-13541MEDIUMCVSS 6.3EG 6.3
2026-06-29
A weakness has been identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /doctorchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The atta…
CVE-2026-13542MEDIUMCVSS 6.3EG 6.3
2026-06-29
A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /doctorprofile.php. The manipulation of the argument doctorname leads to sql injection. It is possible t…
CVE-2026-13548MEDIUMCVSS 6.3EG 6.3
2026-06-29
A vulnerability was identified in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /doctortimings.php. The manipulation of the argument editid leads to sql injection. Remote exploitation of the attac…
CVE-2026-13550HIGHCVSS 7.3EG 7.3
2026-06-29
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.php. This manipulation of the argument ID causes sql injection. The attack is pos…
CVE-2026-13551HIGHCVSS 7.3EG 7.3
2026-06-29
A security vulnerability has been detected in itsourcecode Baptism Information Management System 1.0. This affects an unknown function of the file /editBaptism.php. Such manipulation of the argument ID leads to sql injection. The attack ma…
CVE-2026-13552HIGHCVSS 7.3EG 7.3
2026-06-29
A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.php?action=edit. Performing a manipulation of the argument amen_id results in sql…
CVE-2026-13555HIGHCVSS 7.3EG 7.3
2026-06-29
A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/mod_users/controller.php?action=add. The manipulation of the argument Name results in sql…
CVE-2026-13559HIGHCVSS 7.3EG 7.3
2026-06-29
A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown function of the file /single-list_sale.php?action=add. Executing a manipulation of the argument ID can lead to sql injection. The attack can be…
CVE-2026-13565HIGHCVSS 7.3EG 7.3
2026-06-29
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_class1.php. Executing a manipulation of the argument ID can lead to …
CVE-2026-13566HIGHCVSS 7.3EG 7.3
2026-06-29
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /preview3.php. The manipulation of the argument course_year_section leads to sql injec…
CVE-2026-13569MEDIUMCVSS 4.7EG 4.7
2026-06-29
A security vulnerability has been detected in weng-xianhu EyouCMS up to 1.7.1. This issue affects some unknown processing of the file /index.php of the component API. Such manipulation of the argument click_like leads to sql injection. The…
CVE-2026-13572MEDIUMCVSS 6.3EG 6.3
2026-06-29
A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /insertbillingrecord.php. The manipulation of the argument patientid leads to sql injection. It is possi…
CVE-2026-13578MEDIUMCVSS 6.3EG 6.3
2026-06-29
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /patientdetail.php. Performing a manipulation of the argument editid results in sql …
CVE-2026-13579MEDIUMCVSS 6.3EG 6.3
2026-06-29
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangepassword.php. Executing a manipulation of the argument newpassword can lead to sq…
CVE-2026-1412CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such …
CVE-2026-1413CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performi…
CVE-2026-1414CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Execut…
CVE-2026-1419HIGHCVSS 7.2EG 7.2
2026-01-26
A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injec…
CVE-2026-1422CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results…
CVE-2026-14249HIGHCVSS 7.5EG 7.5
2026-07-02
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attack…
CVE-2026-1443CRITICALCVSS 9.8EG 9.8
2026-01-26
A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack ca…
CVE-2026-1449HIGHCVSS 7.3EG 7.3
2026-01-27
A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/BusComManagement/TireMng.aspx. Executing a manipulation of the argument key can lea…
CVE-2026-14619MEDIUMCVSS 6.3EG 6.3
2026-07-04
A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /medicine.php. This manipulation of the argument editid causes sql injection. Remote exploitation of the…
CVE-2026-14638MEDIUMCVSS 6.3EG 6.3
2026-07-04
A flaw has been found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /patient.php. This manipulation of the argument editid causes sql injection. The attack may be initiated remotely. The explo…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →