CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,217 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 36 of 105

CVE-2025-10786HIGHCVSS 7.3EG 7.3
2025-09-22
A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_user. This manipulation of the argument ID causes sql injection. The attack can be initi…
CVE-2025-10788HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominventory.php. Executing manipulation of the argument ID can lead to sql injection. The…
CVE-2025-10789HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteslide.php. The manipulation of the argument ID leads to sql injection. Remote exploitation …
CVE-2025-10790MEDIUMCVSS 6.3EG 6.3
2025-09-22
A security flaw has been discovered in SourceCodester Simple Forum Discussion System 1.0. This affects an unknown function of the file /ajax.php?action=save_category. The manipulation of the argument Description results in sql injection. T…
CVE-2025-10791HIGHCVSS 7.3EG 7.3
2025-09-22
A weakness has been identified in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/index.php. This manipulation of the argument aduser causes sql injection. The attack is possible to be c…
CVE-2025-10793HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was detected in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/admin_account_delete.php. Performing manipulation of the argument user_id results in sql in…
CVE-2025-10795HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability has been found in code-projects Online Bidding System 1.0. This affects an unknown part of the file /administrator/bidupdate.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remot…
CVE-2025-10796HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin/login.php. The manipulation of the argument email results in sql injection. The attack can be laun…
CVE-2025-10797HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was determined in code-projects Hostel Management System 1.0. This issue affects some unknown processing of the file /justines/index.php. This manipulation of the argument log_email causes sql injection. The attack may be i…
CVE-2025-10798HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.php?view=view. Such manipulation of the argument ID leads to sql injection. The at…
CVE-2025-10799HIGHCVSS 7.3EG 7.3
2025-09-22
A security flaw has been discovered in code-projects Hostel Management System 1.0. The affected element is an unknown function of the file /justines/admin/mod_reservation/index.php?view=view. Performing manipulation of the argument ID resu…
CVE-2025-10800HIGHCVSS 7.3EG 7.3
2025-09-22
A weakness has been identified in itsourcecode Online Discussion Forum 1.0. The impacted element is an unknown function of the file /index.php. Executing manipulation of the argument email/password can lead to sql injection. The attack can…
CVE-2025-10801HIGHCVSS 7.3EG 7.3
2025-09-22
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/edit_tax.php. The manipulation of the argument ID leads to sql injection. The attack is …
CVE-2025-10802HIGHCVSS 7.3EG 7.3
2025-09-22
A flaw has been found in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/remove.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remot…
CVE-2025-10804MEDIUMCVSS 6.3EG 6.3
2025-09-22
A vulnerability was found in Campcodes Online Beauty Parlor Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add-customer.php. Performing manipulation of the argument mobilenum results in sql i…
CVE-2025-10805MEDIUMCVSS 6.3EG 6.3
2025-09-22
A vulnerability was determined in Campcodes Online Beauty Parlor Management System 1.0. This affects an unknown part of the file /admin/add-services.php. Executing manipulation of the argument sername can lead to sql injection. The attack …
CVE-2025-10806MEDIUMCVSS 6.3EG 6.3
2025-09-22
A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql i…
CVE-2025-10807MEDIUMCVSS 6.3EG 6.3
2025-09-22
A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/edit-customer-detailed.php. The manipulation of the argument editid results in sql i…
CVE-2025-10808HIGHCVSS 7.3EG 7.3
2025-09-22
A weakness has been identified in Campcodes Farm Management System 1.0. Impacted is an unknown function of the file /uploadProduct.php. This manipulation of the argument Type causes sql injection. Remote exploitation of the attack is possi…
CVE-2025-10809HIGHCVSS 7.3EG 7.3
2025-09-22
A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. The affected element is an unknown function of the file /admin/department.php. Such manipulation of the argument d leads to sql injection. The a…
CVE-2025-10810HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was detected in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/edit_user.php. Performing manipulation of the argument firstname results in sql injection. The …
CVE-2025-10811HIGHCVSS 7.3EG 7.3
2025-09-22
A flaw has been found in code-projects Hostel Management System 1.0. This affects an unknown function of the file /justines/admin/mod_comments/index.php?view=view. Executing manipulation of the argument ID can lead to sql injection. The at…
CVE-2025-10812HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability has been found in code-projects Hostel Management System 1.0. This impacts an unknown function of the file /justines/admin/mod_amenities/index.php?view=view. The manipulation of the argument ID leads to sql injection. It is…
CVE-2025-10813HIGHCVSS 7.3EG 7.3
2025-09-22
A vulnerability was found in code-projects Hostel Management System 1.0. Affected is an unknown function of the file /justines/admin/mod_reports/index.php. The manipulation of the argument Home results in sql injection. It is possible to l…
CVE-2025-10814MEDIUMCVSS 6.3EG 6.3
2025-09-22
A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack c…
CVE-2025-10817HIGHCVSS 7.3EG 7.3
2025-09-22
A weakness has been identified in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/admin_user.php. Executing manipulation of the argument firstname can lead to sql injection. The a…
CVE-2025-10825MEDIUMCVSS 6.3EG 6.3
2025-09-23
A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. Affected is an unknown function of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack can…
CVE-2025-10826MEDIUMCVSS 6.3EG 6.3
2025-09-23
A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/…
CVE-2025-10828MEDIUMCVSS 6.3EG 6.3
2025-09-23
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be lau…
CVE-2025-10829HIGHCVSS 7.3EG 7.3
2025-09-23
A vulnerability was detected in Campcodes Computer Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/sup_edit1.php. Performing manipulation of the argument ID results in sql injection. Remote exploi…
CVE-2025-10830HIGHCVSS 7.3EG 7.3
2025-09-23
A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/inv_edit1.php. Executing manipulation of the argument idd can lead to sql injection. The attack can b…
CVE-2025-10831HIGHCVSS 7.3EG 7.3
2025-09-23
A vulnerability has been found in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. The manipulation of the argument prodcode leads to sql injection. The attack is possible…
CVE-2025-10832HIGHCVSS 7.3EG 7.3
2025-09-23
A vulnerability was found in SourceCodester Pet Grooming Management Software 1.0. The affected element is an unknown function of the file /admin/fetch_product_details.php. The manipulation of the argument barcode results in sql injection. …
CVE-2025-10833HIGHCVSS 7.3EG 7.3
2025-09-23
A vulnerability was determined in 1000projects Bookstore Management System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument unm causes sql injection. It is possible to initiate the …
CVE-2025-10834HIGHCVSS 7.3EG 7.3
2025-09-23
A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument user_email leads to sql injection. It is possible to laun…
CVE-2025-10835MEDIUMCVSS 6.3EG 6.3
2025-09-23
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/view_payorder.php. Performing manipulation of the argument ID results in sql injection. The att…
CVE-2025-10836HIGHCVSS 7.3EG 7.3
2025-09-23
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/print1.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be la…
CVE-2025-10839MEDIUMCVSS 6.3EG 6.3
2025-09-23
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is p…
CVE-2025-10840MEDIUMCVSS 6.3EG 6.3
2025-09-23
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be …
CVE-2025-10841HIGHCVSS 7.3EG 7.3
2025-09-23
A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php. Such manipulation of the argument ID leads to sql injection. The attack can be l…
CVE-2025-10842HIGHCVSS 7.3EG 7.3
2025-09-23
A vulnerability was detected in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/wew.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated r…
CVE-2025-10843HIGHCVSS 7.3EG 7.3
2025-09-23
A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/paypalpayout.php. Executing manipulation of the argument confirm can lead to sql …
CVE-2025-10844MEDIUMCVSS 6.3EG 6.3
2025-09-23
A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of t…
CVE-2025-10845MEDIUMCVSS 6.3EG 6.3
2025-09-23
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The…
CVE-2025-10846MEDIUMCVSS 6.3EG 6.3
2025-09-23
A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to b…
CVE-2025-10848MEDIUMCVSS 6.3EG 6.3
2025-09-23
A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.php. Such manipulation of the argument student_id leads to sql injection. The atta…
CVE-2025-10851HIGHCVSS 7.3EG 7.3
2025-09-23
A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to in…
CVE-2025-10857HIGHCVSS 7.3EG 7.3
2025-09-23
A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The atta…
CVE-2025-10958MEDIUMCVSS 6.3EG 6.3
2025-09-25
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploita…
CVE-2025-10959MEDIUMCVSS 6.3EG 6.3
2025-09-25
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be ex…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →