CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,217 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 41 of 105

CVE-2025-11904MEDIUMCVSS 6.3EG 6.3
2025-10-17
A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. This affects the function hasUse of the file /cms/model/hasUse. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The explo…
CVE-2025-11905MEDIUMCVSS 6.3EG 6.3
2025-10-17
A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack may be launched remo…
CVE-2025-11909MEDIUMCVSS 6.3EG 6.3
2025-10-17
A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead …
CVE-2025-1191MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/approve-reject.php. The manipulation of the argument br…
CVE-2025-11910MEDIUMCVSS 6.3EG 6.3
2025-10-17
A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection.…
CVE-2025-11911MEDIUMCVSS 6.3EG 6.3
2025-10-17
A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. It is possib…
CVE-2025-11912MEDIUMCVSS 6.3EG 6.3
2025-10-17
A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This manipulation of the argument orderField causes sql injection. The attack can be init…
CVE-2025-1192MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0. It has been classified as critical. Affected is an unknown function of the file select-menu.php. The manipulation of the argument table leads to sql…
CVE-2025-11944MEDIUMCVSS 4.7EG 4.7
2025-10-19
A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initia…
CVE-2025-1197MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /_parse/load_user-profile.php. The manipulation o…
CVE-2025-1199MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been classified as critical. This affects an unknown part of the file /admin/app/role_crud.php. The manipulation of the argument id leads to sql inject…
CVE-2025-1200MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/app/slider_crud.php. The manipulation of the argument del_id lead…
CVE-2025-1201MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/app/profile_crud.php. The manipulation leads to sql injection. Th…
CVE-2025-1202MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability classified as critical has been found in SourceCodester Best Church Management Software 1.1. Affected is an unknown function of the file /admin/edit_slider.php. The manipulation of the argument id leads to sql injection. It…
CVE-2025-1206MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/viewdetailroutine.php. The manipulation of the argument id leads to sql injectio…
CVE-2025-1210MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /controllers/control.php. The manipulation of the argument to leads to sql injectio…
CVE-2025-1216MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort l…
CVE-2025-12208HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is po…
CVE-2025-12215HIGHCVSS 7.3EG 7.3
2025-10-27
A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remot…
CVE-2025-12226MEDIUMCVSS 4.7EG 4.7
2025-10-27
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. Remote exploi…
CVE-2025-12237HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulation of the argument keywords leads to sql injection. The attack can be executed r…
CVE-2025-12238MEDIUMCVSS 6.3EG 6.3
2025-10-27
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attac…
CVE-2025-1224MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can…
CVE-2025-12242MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection.…
CVE-2025-12243MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argumen…
CVE-2025-12248HIGHCVSS 7.3EG 7.3
2025-10-27
A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the argument keyword leads to sql injection. The attack may be performed from remote.…
CVE-2025-12249MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possi…
CVE-2025-12252MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of the argument content results in sql injection. The attack can be launched remotel…
CVE-2025-12253HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injectio…
CVE-2025-12254MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.php. Such manipulation of the argument fullname leads to sql injection. The attack…
CVE-2025-12255MEDIUMCVSS 6.3EG 6.3
2025-10-27
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing manipulation of the argument fullname results in sql injection. Remote exploitat…
CVE-2025-12256MEDIUMCVSS 6.3EG 6.3
2025-10-27
A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Executing manipulation of the argument contestant_id can lead to sql injection. The …
CVE-2025-12257HIGHCVSS 7.3EG 7.3
2025-10-27
A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attack …
CVE-2025-12261MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be…
CVE-2025-12262MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be l…
CVE-2025-12263MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated rem…
CVE-2025-12266MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty of the file /index.php/auth/widget. Performing manipulation of the argument get.l…
CVE-2025-1227MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql injection. The attack may be…
CVE-2025-12277HIGHCVSS 7.3EG 7.3
2025-10-27
A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The atta…
CVE-2025-12287MEDIUMCVSS 4.7EG 4.7
2025-10-27
A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown function of the file /Admin_dashboard/edit_profile. Such manipulation of the argument …
CVE-2025-12292HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack rem…
CVE-2025-12293HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the atta…
CVE-2025-12294MEDIUMCVSS 4.7EG 4.7
2025-10-27
A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated re…
CVE-2025-12306HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried…
CVE-2025-12307HIGHCVSS 7.3EG 7.3
2025-10-27
A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack…
CVE-2025-12308HIGHCVSS 7.3EG 7.3
2025-10-27
A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql in…
CVE-2025-12309HIGHCVSS 7.3EG 7.3
2025-10-27
A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the…
CVE-2025-12313MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launche…
CVE-2025-12314MEDIUMCVSS 4.7EG 4.7
2025-10-27
A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitat…
CVE-2025-12315MEDIUMCVSS 4.7EG 4.7
2025-10-27
A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulation of the argument itemPrice can lead to sql injection. The attack can be execute…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →