CWE-74

High likelihood

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Parent: CWE-707 - Improper Neutralization

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

4,812 vulnerabilities with CWE-74
CVE-2023-29519 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via Attachment Selector Property Field
CVSS 9.0
CVE-2023-29518 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via Invitation.InvitationCommon Page
CVSS 9.9
CVE-2023-29516 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via AttachmentSelector Cancel Button
CVSS 9.9
CVE-2023-29514 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via Document Edit
CVSS 9.9
CVE-2023-29512 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via Improper Escaping in Attachment Handling
CVSS 9.9
CVE-2023-29510 CRITICAL
XWiki < 14.10.2 - Authenticated Remote Code Execution via User Translation Override
CVSS 9.9
CVE-2023-30547 CRITICAL
Vm2 < 3.9.16 - Injection
CVSS 9.8
CVE-2023-29213 CRITICAL
XWiki Platform < 13.10.11 - Authenticated Remote Code Execution via URL Expression Injection
CVSS 9.0
CVE-2023-29383 LOW
Shadow 4.13 - Out-of-bounds Read via Control Character Injection in chfn
CVSS 3.3
CVE-2023-26919 HIGH
delight-nashorn-sandbox <0.2.4-0.2.5 - RCE
CVSS 7.2
CVE-2023-29389 MEDIUM
Toyota RAV4 2021 - Unauthenticated CAN Injection via Forged Key Validation Messages
CVSS 6.8
CVE-2023-29374 CRITICAL
LangChain <0.0.131 - Code Injection
CVSS 9.8
CVE-2023-28853 HIGH
Mastodon <3.5.8, <4.0.4, <4.1.2 - SQL Injection
CVSS 7.7
CVE-2023-27533 HIGH
curl < 8.0 - Remote Code Execution via TELNET Protocol Input Validation
CVSS 8.8
CVE-2023-28637 HIGH
DataEase < 1.18.5 - Remote Code Execution via AWS Redshift Data Source
CVSS 8.0
CVE-2023-26493 HIGH
Cocos Engine < 2023-02-20 - Command Injection via GitHub Actions Workflow
CVSS 8.1
CVE-2023-27040 CRITICAL
Simple Image Gallery Web App 1.0 - Remote Code Execution via Username Parameter
CVSS 9.8
CVE-2023-25616 CRITICAL
SAP Business Objects Business Intelligence Platform 420, 430 - Code Injection via Program Object Execution
CVSS 9.9
CVE-2023-1287 CRITICAL
ENOVIA Live Collaboration >= V6R2013xE < V6R2013xE_FP.CFA.2240 - Remote Code Execution via XSL Template
CVSS 9.0
CVE-2023-26261 CRITICAL
UBIKA WAAP Gateway/Cloud <6.10 - Auth Bypass
CVSS 9.8
CVE-2023-27479 CRITICAL
XWiki 6.3-13.10.10 - Authenticated Remote Code Execution via UIX Parameter Injection
CVSS 9.9
CVE-2023-27635 HIGH
debmany - OS Command Injection via Crafted .deb File
CVSS 7.8
CVE-2023-1061 MEDIUM
Doctors Appointment System 1.0 - SQL Injection via Email Parameter in Edit Doctor Endpoint
CVSS 6.3
CVE-2023-1059 MEDIUM
Doctors Appointment System 1.0 - SQL Injection via search/id Parameter
CVSS 6.3
CVE-2023-20858 HIGH
VMware Carbon Black App Control 8.7.0-8.7.7, 8.8.0-8.8.5, 8.9.0-8.9.3 - Authenticated OS Command Injection
CVSS 7.2
Details
Vulnerabilities 4,812
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits