CWE-74

High likelihood

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Parent: CWE-707 - Improper Neutralization

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

4,516 vulnerabilities with CWE-74
CVE-2026-7028 MEDIUM
CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection
CVSS 4.7
CVE-2026-7023 MEDIUM
ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injection
CVSS 6.3
CVE-2026-7002 HIGH
KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injection
CVSS 7.3
CVE-2026-6994 MEDIUM
Envoy Query Parameter header_mutation.cc params.add injection
CVSS 6.3
CVE-2026-6991 MEDIUM
colinhacks Zod CUID Data Type regexes.ts sql injection
CVSS 6.3
CVE-2026-6989 MEDIUM
Tenda F453 Telnet Service telnet TendaTelnet command injection
CVSS 6.3
CVE-2026-6987 HIGH
PicoClaw Web Launcher Management Plane restart command injection
CVSS 7.3
CVE-2026-6982 MEDIUM
star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injection
CVSS 6.3
CVE-2026-6980 HIGH
Divyanshu-hash GitPilot-MCP main.py repo_path command injection
CVSS 7.3
CVE-2026-6978 MEDIUM
JiZhiCMS addcache.html htmlspecialchars_decode sql injection
CVSS 4.7
CVE-2026-41319 MEDIUM
MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
CVSS 6.5
CVE-2026-6799 MEDIUM
Comfast CF-N1-S Endpoint mbox-config command injection
CVSS 6.3
CVE-2026-1089 MEDIUM
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
CVSS 6.5
CVE-2026-0972 MEDIUM
GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
CVSS 5.4
CVE-2026-6629 HIGH
Metasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection
CVSS 7.3
CVE-2026-6628 MEDIUM
phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection
CVSS 6.3
CVE-2026-6603 HIGH
modelscope agentscope _python.py execute_shell_command code injection
CVSS 7.3
CVE-2026-6599 MEDIUM
langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection
CVSS 6.3
CVE-2026-6595 HIGH
ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection
CVSS 7.3
CVE-2026-6576 MEDIUM
liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection
CVSS 6.3
CVE-2026-6562 HIGH
dameng100 muucmf index.html getListByPage sql injection
CVSS 7.3
CVE-2026-6490 HIGH
QueryMine sms GET Request Parameter deletecourse.php sql injection
CVSS 7.3
CVE-2026-6488 MEDIUM
QueryMine sms GET Request Parameter editcourse.php sql injection
CVSS 6.3
CVE-2026-5797 MEDIUM
Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
CVSS 5.3
CVE-2026-39419 LOW
MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing
CVSS 3.1
Details
Vulnerabilities 4,516
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits