CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,099 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 39 of 122

CVE-2025-11909HIGHCVSS 8.8EG 8.8
2025-10-17
A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead …
CVE-2025-11905HIGHCVSS 8.8EG 8.8
2025-10-17
A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack may be launched remo…
CVE-2025-11667HIGHCVSS 8.8EG 8.8
2025-10-13
A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candidate_modal.php.. The manipulation of the argument firstname results in sql injec…
CVE-2025-11613HIGHCVSS 8.8EG 8.8
2025-10-11
A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of the argument cname results in sql injection. The attack can be launched remotely.…
CVE-2025-11612HIGHCVSS 8.8EG 8.8
2025-10-11
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation of the argument Category leads to sql injection. The attack can be initiated re…
CVE-2025-11611HIGHCVSS 8.8EG 8.8
2025-10-11
A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out re…
CVE-2025-11610HIGHCVSS 8.8EG 8.8
2025-10-11
A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manipulation of the argument editBrandName results in sql injection. The attack can b…
CVE-2025-11605HIGHCVSS 8.8EG 8.8
2025-10-11
A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipulation of the argument uid leads to sql injection. The attack can be executed remo…
CVE-2025-11603HIGHCVSS 8.8EG 8.8
2025-10-11
A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulation of the argument Category results in sql injection. The attack may be launche…
CVE-2025-11600HIGHCVSS 8.8EG 8.8
2025-10-11
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such manipulation of the argument cname leads to sql injection. It is possible to la…
CVE-2025-11593HIGHCVSS 8.8EG 8.8
2025-10-11
A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This manipulation of the argument ID causes sql injection. The attack may be initiated r…
CVE-2025-11592HIGHCVSS 8.8EG 8.8
2025-10-11
A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely.…
CVE-2025-11591HIGHCVSS 8.8EG 8.8
2025-10-11
A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/actions/delete-member.php. The manipulation of the argument ID leads to sql injectio…
CVE-2025-11590HIGHCVSS 8.8EG 8.8
2025-10-11
A weakness has been identified in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/equipment-entry.php. Executing a manipulation of the argument ename can lead to sql inject…
CVE-2025-11589HIGHCVSS 8.8EG 8.8
2025-10-10
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a manipulation of the argument plan results in sql injection. It is possible to ini…
CVE-2025-11588HIGHCVSS 8.8EG 8.8
2025-10-10
A vulnerability was identified in CodeAstro Gym Management System 1.0. This impacts an unknown function of the file /customer/index.php. Such manipulation of the argument fullname leads to sql injection. The attack may be performed from re…
CVE-2025-11552HIGHCVSS 8.8EG 8.8
2025-10-09
A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the at…
CVE-2025-11530HIGHCVSS 8.8EG 8.8
2025-10-09
A weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation of the argument state causes sql injection. The attack is possible to be carried…
CVE-2025-11523HIGHCVSS 8.8EG 8.8
2025-10-09
A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remote…
CVE-2025-11516HIGHCVSS 8.8EG 8.8
2025-10-09
A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible t…
CVE-2025-11515HIGHCVSS 8.8EG 8.8
2025-10-09
A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection.…
CVE-2025-11514HIGHCVSS 8.8EG 8.8
2025-10-09
A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be perfo…
CVE-2025-11478HIGHCVSS 8.8EG 8.8
2025-10-08
A weakness has been identified in SourceCodester Farm Management System 1.0. This issue affects some unknown processing of the file /myCart.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack …
CVE-2025-11410HIGHCVSS 8.8EG 8.8
2025-10-07
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can…
CVE-2025-11409HIGHCVSS 8.8EG 8.8
2025-10-07
A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument voter results in sql injection. Remote expl…
CVE-2025-11359HIGHCVSS 8.8EG 8.8
2025-10-07
A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.php. The manipulation of the argument ID leads to sql injection. Remote exploitat…
CVE-2025-11358HIGHCVSS 8.8EG 8.8
2025-10-07
A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotel…
CVE-2025-11357HIGHCVSS 8.8EG 8.8
2025-10-07
A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /createuser.php. Performing manipulation of the argument Name results in sql injection. The attack may b…
CVE-2025-11330HIGHCVSS 8.8EG 8.8
2025-10-06
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports-detail.php. Such manipulation of the argument fromdate/todate leads to sql inje…
CVE-2025-11303HIGHCVSS 8.8EG 8.8
2025-10-05
A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. The explo…
CVE-2025-11298HIGHCVSS 8.8EG 8.8
2025-10-05
A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the argument m_wan_ipaddr can lead to command injection. The attack may be performe…
CVE-2025-11292HIGHCVSS 8.8EG 8.8
2025-10-05
A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing a manipulation of the argument wan_ipaddr can lead to command injection. The attack can be launche…
CVE-2025-11288HIGHCVSS 8.8EG 8.8
2025-10-05
A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET Parameter Handler. Performing a manipulation of the argument cate_id results in s…
CVE-2025-11121HIGHCVSS 8.8EG 8.8
2025-09-28
A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to command injection. The attack can be initiat…
CVE-2025-11114HIGHCVSS 8.8EG 8.8
2025-09-28
A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence[] can lead to sql injection. T…
CVE-2025-11113HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. T…
CVE-2025-11104HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The manipulation of the argument uid results in sql injection. The attack may be la…
CVE-2025-11100HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is…
CVE-2025-11099HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate …
CVE-2025-11098HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed fr…
CVE-2025-11097HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remote…
CVE-2025-11096HIGHCVSS 8.8EG 8.8
2025-09-28
A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed r…
CVE-2025-11095HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation o…
CVE-2025-11092HIGHCVSS 8.8EG 8.8
2025-09-28
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiat…
CVE-2025-11090HIGHCVSS 8.8EG 8.8
2025-09-28
A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected is an unknown function of the file /admin/employee/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initi…
CVE-2025-11088HIGHCVSS 8.8EG 8.8
2025-09-28
A weakness has been identified in itsourcecode Open Source Job Portal 1.0. Impacted is an unknown function of the file /admin/vacancy/index.php?view=edit. This manipulation of the argument ID causes sql injection. Remote exploitation of th…
CVE-2025-11054HIGHCVSS 8.8EG 8.8
2025-09-27
A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/category/index.php?view=edit. The manipulation of the argument ID leads to sql injection. …
CVE-2025-11041HIGHCVSS 8.8EG 8.8
2025-09-26
A vulnerability has been found in itsourcecode Open Source Job Portal 1.0. Affected by this issue is some unknown functionality of the file /admin/user/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The at…
CVE-2025-11038HIGHCVSS 8.8EG 8.8
2025-09-26
A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Affected is an unknown function of the file /details.php?action=post. Executing manipulation of the argument ID can lead to sql injection. The attack may b…
CVE-2025-10964HIGHCVSS 8.8EG 8.8
2025-09-25
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack …

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →