CWE-147: Improper Neutralization of Input Terminators
Filter
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
What the weakness is: CWE-147 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-460 HTTP Parameter Pollution (HPP) Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-147, as MITRE names them. Credits.
Ask an AI about CWE-147
Show the prompt
Explain CWE-147: Improper Neutralization of Input Terminators and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/147.html and https://cve.bz/cve/cwe/147?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2026-113602EPSS 0.4%
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONV…
- 9.8CVE-2026-82989EPSS 0.7%
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoin…
- 6.0CVE-2025-7962EPSS 0.9%
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
- 2.1CVE-2024-52006EPSS 1.0%
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information b…
- 2.1CVE-2024-50349EPSS 0.7%
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using …
- 5.4CVE-2024-52505EPSS 0.4%
matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the…
- 6.1CVE-2023-4393EPSS 0.4%
HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.