cve.bz

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection), page 97

Filter

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

What the weakness is: CWE-74 at MITRE

Ask an AI about CWE-74

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/74.html and https://cve.bz/cve/cwe/74?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2023-7114EPSS 0.5%

    Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.

  2. 5.3CVE-2023-52081EPSS 0.5%

    ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use…

  3. 9.8CVE-2023-51664EPSS 3.4%

    tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code a…

  4. 7.2CVE-2023-49328EPSS 1.0%

    On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.

  5. 5.3CVE-2023-7100EPSS 0.7%

    A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate/tdate lea…

  6. 2.0CVE-2023-7096EPSS 0.7%

    A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is po…

  7. 9.8CVE-2023-7039EPSS 14%

    A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attac…

  8. 9.8CVE-2023-35895EPSS 0.9%

    IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 259116.

  9. 9.8CVE-2023-46726EPSS 1.3%

    GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI docum…

  10. 9.8CVE-2023-43364EPSS 2.9%

    main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

  11. 9.8CVE-2023-46456EPSS 25%

    In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.

  12. 8.8CVE-2023-49964EPSS 35%

    An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarke…

  13. 6.9CVE-2023-6648EPSS 1.0%

    A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file password-recovery.php. The manipulation of the argument username/contactno leads…

  14. 8.8CVE-2023-48841EPSS 1.2%

    Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.

  15. 8.8CVE-2023-48835EPSS 1.2%

    Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.

  16. 8.8CVE-2023-48830EPSS 1.2%

    Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export.

  17. 8.8CVE-2023-48826EPSS 1.2%

    Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List.

  18. 5.3CVE-2023-48205EPSS 0.8%

    Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.

  19. 9.8CVE-2023-6458EPSS 0.6%

    Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

  20. 8.8CVE-2023-22522EPSS 13%

    This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE…

  21. 5.4CVE-2023-35075EPSS 0.4%

    Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.

  22. 9.8CVE-2023-49214EPSS 0.8%

    Usedesk before 1.7.57 allows chat template injection.

  23. 4.8CVE-2023-6164EPSS 0.4%

    The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitizati…

  24. 9.8CVE-2023-5340EPSS 1.2%

    The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present o…

  25. 9.8CVE-2022-46337EPSS 1.4%

    A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, thi…

  26. 6.5CVE-2023-6174EPSS 0.7%

    SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file

  27. 7.8CVE-2023-48199EPSS 0.5%

    HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the in…

  28. 9.4CVE-2023-44373EPSS 1.3%

    Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.

  29. 6.1CVE-2023-47119EPSS 0.9%

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through…

  30. 9.8CVE-2017-20187EPSS 0.7%Unsupported when assigned

    A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to inje…

  31. 6.1CVE-2023-4767EPSS 2.9%

    A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fi…

  32. 8.8CVE-2023-4197EPSS 36%

    Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.

  33. 6.1CVE-2023-4393EPSS 0.4%

    HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.

  34. 7.8CVE-2023-46468EPSS 0.6%

    An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.

  35. 8.8CVE-2023-5043EPSS 2.5%

    Ingress nginx annotation injection causes arbitrary command execution.

  36. 7.5CVE-2023-32786EPSS 0.7%

    In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

  37. 9.8CVE-2022-47583EPSS 1.2%

    Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.

  38. 6.5CVE-2023-45540EPSS 0.7%

    An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.

  39. 7.5CVE-2023-43667EPSS 1.7%

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log r…

  40. 8.8CVE-2023-43661EPSS 52%

    Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb0…

  41. 7.5CVE-2023-44109EPSS 0.4%

    Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality.

  42. 8.8CVE-2023-45303EPSS 1.0%

    ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

  43. 5.3CVE-2022-4145EPSS 0.6%

    A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling the obfuscation of a phishing operation.

  44. 7.8CVE-2023-3665EPSS 0.2%

    A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code.

  45. 8.8CVE-2023-43835EPSS 1.7%

    Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content.

  46. 7.5CVE-2023-41580EPSS 0.9%

    Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitiv…

  47. 5.3CVE-2023-44270EPSS 1.0%

    An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. Af…

  48. 8.8CVE-2023-43655EPSS 1.5%

    Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `reg…

  49. 5.1CVE-2023-5269EPSS 0.8%

    A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the…

  50. 5.3CVE-2023-26148EPSS 0.4%

    All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the …