CWE-74

High likelihood

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Parent: CWE-707 - Improper Neutralization

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

4,795 vulnerabilities with CWE-74
CVE-2026-0568 HIGH
Online Music Site 1.0 - SQL Injection via ViewSongs.php ID Parameter
CVSS 7.3
CVE-2026-0567 HIGH
code-projects Content Management System 1.0 - SQL Injection via ID Parameter in pages.php
CVSS 7.3
CVE-2026-0565 HIGH
code-projects Content Management System 1.0 - SQL Injection via del Parameter in admin/delete.php
CVSS 7.3
CVE-2026-0546 HIGH
code-projects Content Management System 1.0 - SQL Injection via search.php Value Parameter
CVSS 7.3
CVE-2026-0544 HIGH
itsourcecode School Management System 1.0 - SQL Injection via ID Parameter in /student/index.php
CVSS 7.3
CVE-2025-27511 HIGH
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
CVSS 7.2
CVE-2025-8154 MEDIUM
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
CVSS 5.3
CVE-2025-67486 HIGH
Dolibarr <=22.0.2 User Extrafields - Authenticated Code Execution
CVSS 7.2
CVE-2025-13462 LOW
CPython Tarfile Archive Misinterpretation via AREGTYPE Block Normalization
CVSS 3.3
CVE-2025-67733 HIGH
Valkey <9.0.2/8.1.6/8.0.7/7.2.12 - Info Disclosure
CVSS 8.5
CVE-2025-41083 MEDIUM
Altitude <8.5.3290.0 - Open Redirect
CVE-2025-15496 MEDIUM
yshopmall < 1.9.1 - SQL Injection via /api/jobs sort Parameter
CVSS 6.3
CVE-2025-15494 MEDIUM
DocSys < 2.02.37 - SQL Injection via Username Parameter
CVSS 6.3
CVE-2025-15493 MEDIUM
docsys < 2.02.36 - SQL Injection via searchWord Parameter
CVSS 6.3
CVE-2025-15492 MEDIUM
docsys < 2.02.36 - SQL Injection via searchWord Argument
CVSS 6.3
CVE-2025-15450 MEDIUM
sfturing hosp_order - SQL Injection
CVSS 6.3
CVE-2025-15443 MEDIUM
crmeb < 5.6.1 - SQL Injection via cate_id Parameter in Product Export
CVSS 4.7
CVE-2025-15442 MEDIUM
crmeb < 5.6.1 - SQL Injection via cate_id Parameter in Product List Export
CVSS 4.7
CVE-2025-15439 MEDIUM
Daptin 0.10.3 - SQL Injection via Aggregate API goqu.L Function
CVSS 6.3
CVE-2025-15436 HIGH
Yonyou KSOA 9.0 - SQL Injection via Report Parameter in worksheet/work_edit.jsp
CVSS 7.3
CVE-2025-15435 HIGH
Yonyou KSOA 9.0 - SQL Injection via /worksheet/work_update.jsp Report Parameter
CVSS 7.3
CVE-2025-15434 HIGH
Yonyou KSOA 9.0 - SQL Injection via /kp/PrintZPYG.jsp zpjhid Parameter
CVSS 7.3
CVE-2025-15425 HIGH
Yonyou KSOA 9.0 - SQL Injection via /worksheet/del_user.jsp ID Parameter
CVSS 7.3
CVE-2025-15424 HIGH
Yonyou KSOA 9.0 - SQL Injection via worksheet/agent_worksdel.jsp ID Parameter
CVSS 7.3
CVE-2025-15421 HIGH
Yonyou KSOA 9.0 - SQL Injection via worksheetagent_worksadd.jsp ID Parameter
CVSS 7.3
Details
Vulnerabilities 4,795
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits