CWE-74

High likelihood

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Parent: CWE-707 - Improper Neutralization

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

4,984 vulnerabilities with CWE-74
CVE-2026-9342 MEDIUM
SourceCodester Hospitals Patient Records Management System view_history.php sql injection
CVSS 6.3
CVE-2026-9305 MEDIUM
QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection
CVSS 6.3
CVE-2026-9302 MEDIUM
546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection
CVSS 6.3
CVE-2026-9297 MEDIUM
Edimax BR-6428NS POST Request formWlbasic command injection
CVSS 6.3
CVE-2026-9296 MEDIUM
Edimax BR-6428NS POST Request formWlanM system command injection
CVSS 6.3
CVE-2026-6279 CRITICAL
Avada (Fusion) Builder <= 3.15.2 - Remote Code Execution via PHP Function Injection
CVSS 9.8
CVE-2026-20199 MEDIUM
Cisco ThousandEyes Enterprise Agent - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS 4.7
CVE-2026-8785 HIGH
projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
CVSS 7.3
CVE-2026-8777 MEDIUM
Edimax BR-6428NS POST Request formStaDrvSetup command injection
CVSS 6.3
CVE-2026-8774 MEDIUM
Edimax BR-6228NC POST Request mp command injection
CVSS 6.3
CVE-2026-8773 MEDIUM
linlinjava litemall Database Setting DbUtil.java load argument injection
CVSS 4.7
CVE-2026-8772 MEDIUM
linlinjava litemall Admin Endpoint sql injection
CVSS 4.7
CVE-2026-8771 HIGH
linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection
CVSS 7.3
CVE-2026-8753 MEDIUM
kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
CVSS 6.3
CVE-2026-8734 HIGH
Oinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection
CVSS 7.3
CVE-2026-8724 MEDIUM
Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
CVSS 4.7
CVE-2026-42334 HIGH
Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
CVSS 7.5
CVE-2026-44458 MEDIUM
Hono: CSS Declaration Injection via Style Object Values in JSX SSR
CVSS 4.3
CVE-2026-44455 MEDIUM
Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection
CVSS 4.7
CVE-2026-44246 HIGH
nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`
CVSS 7.2
CVE-2026-42838 MEDIUM
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS 5.4
CVE-2026-41109 HIGH
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVSS 8.8
CVE-2026-33833 HIGH
Azure Machine Learning Notebook Spoofing Vulnerability
CVSS 8.2
CVE-2026-8346 MEDIUM
D-Link DIR-816 portForward command injection
CVSS 6.3
CVE-2026-8345 MEDIUM
D-Link DIR-816 singlePortForward sub_445E7C command injection
CVSS 6.3
Details
Vulnerabilities 4,984
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits