cve.bz

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection), page 4

Filter

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

What the weakness is: CWE-74 at MITRE

Ask an AI about CWE-74

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/74.html and https://cve.bz/cve/cwe/74?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.1CVE-2026-108927EPSS 0.2%

    A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument b_id causes sql injection. It is possible to init…

  2. 2.1CVE-2026-108926EPSS 0.2%

    A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed…

  3. 9.3CVE-2026-108918EPSS 2.0%

    A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. T…

  4. 9.3CVE-2026-108917EPSS 2.0%

    A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be pe…

  5. 5.5CVE-2026-108916EPSS 1.7%

    A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be car…

  6. 6.3CVE-2026-109275EPSS 0.3%

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScrip…

  7. 5.5CVE-2026-108900EPSS 0.3%

    A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. T…

  8. 2.0CVE-2026-108829EPSS 0.3%

    A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results i…

  9. 1.2CVE-2026-108828EPSS 0.2%

    A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack…

  10. 1.2CVE-2026-108827EPSS 0.2%

    A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument…

  11. 5.5CVE-2026-108826EPSS 0.3%

    A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results …

  12. 2.1CVE-2026-108824EPSS 0.2%

    A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possib…

  13. 2.1CVE-2026-108821EPSS 0.2%

    A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack i…

  14. 2.1CVE-2026-108816EPSS 0.2%

    A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The…

  15. 2.1CVE-2026-108814EPSS 0.2%

    A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and…

  16. 2.1CVE-2026-108813EPSS 0.2%

    A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now publ…

  17. 5.5CVE-2026-108807EPSS 0.3%

    A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source/adminregister.php of the component Registration Handler. Performing …

  18. 5.5CVE-2026-108806EPSS 0.3%

    A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Passwor…

  19. 5.5CVE-2026-108805EPSS 0.3%

    A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler.…

  20. 5.5CVE-2026-108799EPSS 0.3%

    A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password …

  21. 5.3CVE-2026-108794EPSS 0.2%

    A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migr…

  22. 2.1CVE-2026-108782EPSS 0.2%

    A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of …

  23. 2.1CVE-2026-108781EPSS 0.2%

    A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of th…

  24. 2.1CVE-2026-108779EPSS 0.2%

    A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument…

  25. 2.1CVE-2026-108778EPSS 0.2%

    A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda …

  26. 2.1CVE-2026-108777EPSS 0.2%

    A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results…

  27. 2.1CVE-2026-108775EPSS 0.2%

    A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The man…

  28. 2.1CVE-2026-108774EPSS 0.2%

    A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument b…

  29. 2.1CVE-2026-108773EPSS 0.2%

    A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode resu…

  30. 5.3CVE-2026-108684EPSS 0.3%

    A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a ma…

  31. 5.5CVE-2026-108571EPSS 0.3%

    A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument I…

  32. 2.1CVE-2026-108569EPSS 0.2%

    A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name …

  33. 2.1CVE-2026-108541EPSS 0.3%

    A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitati…

  34. 5.4CVE-2026-102291EPSS 0.3%

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` …

  35. 4.8CVE-2026-84220EPSS 0.1%

    The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes…

  36. 8.8CVE-2026-76472EPSS 0.1%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address…

  37. 5.4CVE-2026-86833EPSS 0.2%

    The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the a…

  38. 7.1CVE-2026-102158EPSS 0.3%

    Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.

  39. 6.9CVE-2026-102156EPSS 0.3%

    Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.

  40. 2.1CVE-2026-105957EPSS 0.2%

    A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injec…

  41. 2.1CVE-2026-105921EPSS 0.2%

    A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to…

  42. 3.7CVE-2026-105800EPSS 0.3%

    i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begin…

  43. 5.5CVE-2026-105920EPSS 0.3%

    A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endp…

  44. 5.5CVE-2026-105919EPSS 0.3%

    A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint…

  45. 5.5CVE-2026-105918EPSS 0.3%

    A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the a…

  46. 6.9CVE-2026-105807EPSS 0.3%

    A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

  47. 5.5CVE-2026-105776EPSS 0.3%

    A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. T…

  48. 2.1CVE-2026-105472EPSS 0.2%

    A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipul…

  49. 9.8CVE-2026-82989EPSS 0.7%

    There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoin…

  50. 5.5CVE-2026-105471EPSS 0.3%

    A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipula…