CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,439 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 99 of 109

CVE-2026-4570HIGHCVSS 8.8EG 8.8
2026-03-23
A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the component HTTP POST Request Handler. Such manipulation of the argument searchtxt leads …
CVE-2026-4571MEDIUMCVSS 6.5EG 6.5
2026-03-23
A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_payments.php of the component HTTP POST Request Handler. Performing a manipu…
CVE-2026-4572MEDIUMCVSS 6.5EG 6.5
2026-03-23
A weakness has been identified in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /view_product.php of the component HTTP POST Request Handler. Executing a manipulation of the…
CVE-2026-4573MEDIUMCVSS 6.3EG 6.3
2026-03-23
A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/form_handlers/delete_post.php of the component HTTP GET Parameter Handler. The manipulation of th…
CVE-2026-4574MEDIUMCVSS 6.3EG 6.3
2026-03-23
A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is p…
CVE-2026-4579CRITICALCVSS 9.8EG 9.8
2026-03-23
A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parameters Handler. The manipulation of the argument serviceId leads to sql injection.…
CVE-2026-4580CRITICALCVSS 9.8EG 9.8
2026-03-23
A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkupdatestatus.php of the component Parameters Handler. The manipulation of the argument serviceId results in …
CVE-2026-4581CRITICALCVSS 9.8EG 9.8
2026-03-23
A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Parameters Handler. This manipulation of the argument Username causes sql injection. Th…
CVE-2026-4597MEDIUMCVSS 6.3EG 6.3
2026-03-23
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of the component Stream Prox…
CVE-2026-4612HIGHCVSS 7.3EG 7.3
2026-03-23
A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument…
CVE-2026-4613HIGHCVSS 7.3EG 7.3
2026-03-24
A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The …
CVE-2026-4614MEDIUMCVSS 6.3EG 6.3
2026-03-24
A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php of the component Parameter Handler. This manipulation of the argument subject_co…
CVE-2026-4615HIGHCVSS 7.3EG 7.3
2026-03-24
A vulnerability was identified in SourceCodester Online Catering Reservation 1.0. Impacted is an unknown function of the file /search.php. Such manipulation of the argument rcode leads to sql injection. The attack may be performed from rem…
CVE-2026-4624HIGHCVSS 7.3EG 7.3
2026-03-24
A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the component Parameter Handler. Performing a manipulation of the argument searchFiel…
CVE-2026-4625HIGHCVSS 7.3EG 7.3
2026-03-24
A flaw has been found in SourceCodester Online Admission System 1.0. This affects an unknown function of the file /programmes.php. Executing a manipulation of the argument program can lead to sql injection. The attack can be launched remot…
CVE-2026-4632HIGHCVSS 7.3EG 7.3
2026-03-24
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name…
CVE-2026-46546MEDIUMCVSS 5.4EG 5.4
2026-06-10
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surface…
CVE-2026-47162HIGHCVSS 8.8EG 8.8
2026-06-11
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing brow…
CVE-2026-47634HIGHCVSS 5.4EG 7.3
2026-06-09
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-47644HIGHCVSS 7.5EG 7.5
2026-06-04
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
CVE-2026-4777MEDIUMCVSS 6.5EG 6.5
2026-03-24
A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file view_supplier.php of the component POST Parameter Handler. The manipulation of the argument searchtxt results in…
CVE-2026-4778MEDIUMCVSS 6.5EG 6.5
2026-03-24
A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid cau…
CVE-2026-4779HIGHCVSS 8.8EG 8.8
2026-03-24
A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of the file update_customer_details.php of the component HTTP GET Parameter Handler. Such manipulation …
CVE-2026-4780HIGHCVSS 8.8EG 8.8
2026-03-25
A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standing.php of the component HTTP GET Parameter Handler. Performing a manipulation of the argument sid r…
CVE-2026-4781HIGHCVSS 8.8EG 8.8
2026-03-25
A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purchase.php of the component HTTP GET Parameter Handler. Executing a manipulation of the argument sid c…
CVE-2026-4783MEDIUMCVSS 6.3EG 6.3
2026-03-25
A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/add-single-student-results.php of the component Parameter Handler. The manipulation of the argumen…
CVE-2026-4784CRITICALCVSS 9.8EG 9.8
2026-03-25
A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the component Parameter Handler. The manipulation of the argument serviceId results in sql injection. …
CVE-2026-48120HIGHCVSS 8.6EG 8.6
2026-08-07
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a …
CVE-2026-48203CRITICALCVSS 9.1EG 9.1
2026-07-06
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies…
CVE-2026-4825MEDIUMCVSS 6.5EG 6.5
2026-03-25
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file /update_sales.php of the component HTTP GET Parameter Handler. The manipulation of the argument sid results in sql injecti…
CVE-2026-4826HIGHCVSS 8.8EG 8.8
2026-03-26
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /update_stock.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid cause…
CVE-2026-4836MEDIUMCVSS 6.3EG 6.3
2026-03-26
A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /my_account/delete.php. Performing a manipulation of the argument cos_id results in sql injection. It is possible …
CVE-2026-4838HIGHCVSS 7.3EG 7.3
2026-03-26
A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the att…
CVE-2026-4839HIGHCVSS 7.3EG 7.3
2026-03-26
A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the component Parameter Handler. The manipulation of the argument custom leads to sql injection. The a…
CVE-2026-4841HIGHCVSS 7.3EG 7.3
2026-03-26
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql inj…
CVE-2026-4842HIGHCVSS 7.3EG 7.3
2026-03-26
A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/grades/index.php?view=edit&id=1 of the component Parameter Handler. The manipulation of the a…
CVE-2026-4844HIGHCVSS 7.3EG 7.3
2026-03-26
A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the component Admin Login Module. The manipulation of the argument Username results in sql …
CVE-2026-4850CRITICALCVSS 9.8EG 9.8
2026-03-26
A security flaw has been discovered in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checkregisitem.php of the component Parameter Handler. The manipulation of the argument Long-arm-shirtVol results …
CVE-2026-4876MEDIUMCVSS 6.3EG 6.3
2026-03-26
A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql inject…
CVE-2026-48813HIGHCVSS 8.7EG 8.7
2026-06-26
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injec…
CVE-2026-4908CRITICALCVSS 9.8EG 9.8
2026-03-27
A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in sql injec…
CVE-2026-49097MEDIUMCVSS 6.5EG 6.5
2026-07-06
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC m…
CVE-2026-49098MEDIUMCVSS 5.3EG 5.3
2026-07-06
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kafka Component. The camel-kafka producer can override its configured target topic…
CVE-2026-49099MEDIUMCVSS 5.3EG 5.3
2026-07-06
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolve…
CVE-2026-4910HIGHCVSS 7.3EG 7.3
2026-03-27
A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads t…
CVE-2026-49452MEDIUMCVSS 6.5EG 6.5
2026-07-06
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute i…
CVE-2026-4954MEDIUMCVSS 6.3EG 6.3
2026-03-27
A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql inj…
CVE-2026-4955HIGHCVSS 7.3EG 7.3
2026-03-27
A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. This impacts an unknown function of the file /OperateStatistic.do. The manipulation of the argument VehicleID results in sql injection. The attack can be laun…
CVE-2026-4956HIGHCVSS 7.3EG 7.3
2026-03-27
A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file /DevicePrint.do?Action=ReadTask of the component Parameter Handler. The manipulation of the argumen…
CVE-2026-4963CRITICALCVSS 10.0EG 10.0
2026-03-27
A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-995…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →