cve.bz

CWE-149: Improper Neutralization of Quoting Syntax

Filter

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

What the weakness is: CWE-149 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-468 Generic Cross-Browser Cross-Domain Theft Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-149, as MITRE names them. Credits.

Ask an AI about CWE-149

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-149: Improper Neutralization of Quoting Syntax and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/149.html and https://cve.bz/cve/cwe/149?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.0CVE-2026-119301EPSS 0.3%

    Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permiss…

  2. 8.1CVE-2026-42511EPSS 0.4%

    The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, …

  3. 9.3CVE-2018-25135EPSS 0.7%

    Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or '…

  4. 8.3CVE-2025-43878EPSS 0.2%

    When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-C/A system…

  5. 8.1CVE-2025-1094ExploitEPSS 90%

    Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns…

  6. 3.1CVE-2023-36479EPSS 1.2%

    Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.serv…