cve.bz

CWE-76: Improper Neutralization of Equivalent Special Elements

Filter

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

What the weakness is: CWE-76 at MITRE. OWASP Top 10: A05:2025 Injection

Ask an AI about CWE-76

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-76: Improper Neutralization of Equivalent Special Elements and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/76.html and https://cve.bz/cve/cwe/76?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-91184EPSS 0.5%

    Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_b…

  2. 8.7CVE-2026-77180EPSS 0.5%

    When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX conf…

  3. 8.6CVE-2026-66362EPSS 0.6%

    Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentic…

  4. 8.7CVE-2026-54722EPSS 0.6%

    DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the UR…

  5. 8.7CVE-2026-55723EPSS 0.5%

    When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are…

  6. 8.6CVE-2026-11311EPSS 0.6%

    When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Reso…

  7. 9.8CVE-2026-28292EPSS 1.3%

    `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remot…

  8. 8.4CVE-2024-4897EPSS 0.4%

    parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from…

  9. 9.6CVE-2024-34359EPSS 26%

    llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several pa…

  10. 9.8CVE-2024-2952EPSS 1.3%

    BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` f…

  11. 6.1CVE-2024-1883EPSS 61%

    This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious l…

  12. 7.2CVE-2024-1882EPSS 1.4%

    This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.

  13. 3.1CVE-2024-1221EPSS 0.5%

    This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token…

  14. 6.5CVE-2024-21600EPSS 0.3%

    An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When …

  15. 5.4CVE-2023-1149EPSS 0.5%

    Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.

  16. 8.8CVE-2023-0493ExploitEPSS 7.9%

    Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.