CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,099 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 40 of 122

CVE-2025-10963HIGHCVSS 8.8EG 8.8
2025-09-25
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch t…
CVE-2025-10962HIGHCVSS 8.8EG 8.8
2025-09-25
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac_5g leads to command injection. It i…
CVE-2025-10960HIGHCVSS 8.8EG 8.8
2025-09-25
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument delete_list results in c…
CVE-2025-10959HIGHCVSS 8.8EG 8.8
2025-09-25
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be ex…
CVE-2025-10958HIGHCVSS 8.8EG 8.8
2025-09-25
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploita…
CVE-2025-10848HIGHCVSS 8.8EG 8.8
2025-09-23
A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.php. Such manipulation of the argument student_id leads to sql injection. The atta…
CVE-2025-10846HIGHCVSS 8.8EG 8.8
2025-09-23
A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to b…
CVE-2025-10845HIGHCVSS 8.8EG 8.8
2025-09-23
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The…
CVE-2025-10844HIGHCVSS 8.8EG 8.8
2025-09-23
A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of t…
CVE-2025-10840HIGHCVSS 8.8EG 8.8
2025-09-23
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be …
CVE-2025-10839HIGHCVSS 8.8EG 8.8
2025-09-23
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is p…
CVE-2025-10835HIGHCVSS 8.8EG 8.8
2025-09-23
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/view_payorder.php. Performing manipulation of the argument ID results in sql injection. The att…
CVE-2025-10828HIGHCVSS 8.8EG 8.8
2025-09-23
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be lau…
CVE-2025-10826HIGHCVSS 8.8EG 8.8
2025-09-23
A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/…
CVE-2025-10825HIGHCVSS 8.8EG 8.8
2025-09-23
A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. Affected is an unknown function of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack can…
CVE-2025-10814HIGHCVSS 8.8EG 8.8
2025-09-22
A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack c…
CVE-2025-10634HIGHCVSS 8.8EG 8.8
2025-09-18
A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal…
CVE-2025-10625HIGHCVSS 8.8EG 8.8
2025-09-17
A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=update_profile. The manipulation of the argument phone results …
CVE-2025-10618HIGHCVSS 8.8EG 8.8
2025-09-17
A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to sql injecti…
CVE-2025-10617HIGHCVSS 8.8EG 8.8
2025-09-17
A weakness has been identified in SourceCodester Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/positions.php. This manipulation of the argument ID causes sql injection. The attack …
CVE-2025-10613HIGHCVSS 8.8EG 8.8
2025-09-17
A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be pe…
CVE-2025-10602HIGHCVSS 8.8EG 8.8
2025-09-17
A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s1.php. Performing manipulation of the argument ID results in sql injection. …
CVE-2025-10595HIGHCVSS 8.8EG 8.8
2025-09-17
A vulnerability has been found in SourceCodester Online Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/delete_user.php. The manipulation of the argument user_id leads to sql inje…
CVE-2025-10594HIGHCVSS 8.8EG 8.8
2025-09-17
A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_student.php. Executing manipulation of the argument stud_id can lead to…
CVE-2025-10593HIGHCVSS 8.8EG 8.8
2025-09-17
A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/update_student.php. Performing manipulation of the argument stud_id results in sql injection. It i…
CVE-2025-10592HIGHCVSS 8.8EG 8.8
2025-09-17
A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument search_f…
CVE-2025-10420HIGHCVSS 8.8EG 8.8
2025-09-15
A vulnerability was detected in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /form137.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. Th…
CVE-2025-10387HIGHCVSS 8.8EG 8.8
2025-09-14
A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1. This vulnerability affects unknown code of the file /handshake.php. This manipulation of the argument machine_name/computer_user/os/date/time/ip/location/systemi…
CVE-2025-10210HIGHCVSS 8.8EG 8.8
2025-09-10
A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launche…
CVE-2025-10110HIGHCVSS 8.8EG 8.8
2025-09-08
A vulnerability was identified in ChanCMS up to 3.3.1. Impacted is an unknown function of the file /search/. The manipulation with the input '%20or%201=1%20%23/words.html leads to sql injection. Remote exploitation of the attack is possibl…
CVE-2025-10012HIGHCVSS 8.8EG 8.8
2025-09-05
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection.…
CVE-2025-9756HIGHCVSS 8.8EG 8.8
2025-09-01
A vulnerability was found in PHPGurukul User Management System 1.0. This impacts an unknown function of the file /admin/change-emailid.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely.…
CVE-2025-9690HIGHCVSS 8.8EG 8.8
2025-08-30
A flaw has been found in SourceCodester Advanced School Management System 1.0. This affects an unknown function of the file /index.php/stock/vendordetails. This manipulation of the argument ID causes sql injection. The attack can be initia…
CVE-2025-9689HIGHCVSS 8.8EG 8.8
2025-08-30
A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/stock/item_select. The manipulation of the argument q results in sql injection. It is …
CVE-2025-9686HIGHCVSS 8.8EG 8.8
2025-08-30
A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/AreaConhecimento/edit of the component Listagem de áreas de conhecimento Page. Performing manipulation o…
CVE-2025-9685HIGHCVSS 8.8EG 8.8
2025-08-30
A vulnerability was identified in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/AreaConhecimento/view of the component Listagem de áreas de conhecimento Page. Such manipulation of the argument…
CVE-2025-9684HIGHCVSS 8.8EG 8.8
2025-08-30
A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injec…
CVE-2025-9667HIGHCVSS 8.8EG 8.8
2025-08-29
A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown part of the file /delete_account.php of the component Admin Panel. Performing manipulation of the argument ID results in sql injection. The at…
CVE-2025-9666HIGHCVSS 8.8EG 8.8
2025-08-29
A security vulnerability has been detected in code-projects Simple Grading System 1.0. Affected by this issue is some unknown functionality of the file /delete_student.php of the component Admin Panel. Such manipulation of the argument ID …
CVE-2025-9665HIGHCVSS 8.8EG 8.8
2025-08-29
A weakness has been identified in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_student.php of the component Admin Panel. This manipulation of the argument ID causes s…
CVE-2025-9664HIGHCVSS 8.8EG 8.8
2025-08-29
A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection.…
CVE-2025-9663HIGHCVSS 8.8EG 8.8
2025-08-29
A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possi…
CVE-2025-9608HIGHCVSS 8.8EG 8.8
2025-08-29
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql inje…
CVE-2025-9607HIGHCVSS 8.8EG 8.8
2025-08-29
A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argu…
CVE-2025-9606HIGHCVSS 8.8EG 8.8
2025-08-29
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql i…
CVE-2025-9586HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be perform…
CVE-2025-9585HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possibl…
CVE-2025-9584HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of the argument interface/display_name results in command injection. The attack ca…
CVE-2025-9583HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulation leads to command injection. Remote exploitation of the attack is possible. The…
CVE-2025-9532HIGHCVSS 8.8EG 8.8
2025-08-27
A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. …

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →