CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,064 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 11 of 122

CVE-2025-13300CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected is an unknown function of the file /settings/controller.php. The manipulation leads to sql injection. It is possible to initiate t…
CVE-2025-13299CRITICALCVSS 9.8EG 9.8
2025-11-17
A flaw has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. This impacts an unknown function of the file /user/controller.php. Executing a manipulation can lead to sql injection. The attack may be performed f…
CVE-2025-13298CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. This affects an unknown function of the file /enrollment/controller.php. Performing a manipulation results in sql injection. The attack is po…
CVE-2025-13297CRITICALCVSS 9.8EG 9.8
2025-11-17
A security vulnerability has been detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. The impacted element is an unknown function of the file /course/controller.php. Such manipulation leads to sql injection. The a…
CVE-2025-13291CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initi…
CVE-2025-13285CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remo…
CVE-2025-13280CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php of the component Login. Executing a manipulation of the argument Username can lead to sql injection…
CVE-2025-13277CRITICALCVSS 9.8EG 9.8
2025-11-17
A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remote…
CVE-2025-13272CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Affected is an unknown function of the file /manage_course.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed …
CVE-2025-13271CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitatio…
CVE-2025-13267CRITICALCVSS 9.8EG 9.8
2025-11-17
A vulnerability was detected in SourceCodester Dental Clinic Appointment Reservation System 1.0. Impacted is an unknown function of the file /success.php. Performing manipulation of the argument username/password results in sql injection. …
CVE-2025-13257CRITICALCVSS 9.8EG 9.8
2025-11-17
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /admin/user/index.php?view=edit. The manipulation of the argument ID leads to sql injection…
CVE-2025-13248CRITICALCVSS 9.8EG 9.8
2025-11-16
A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is an unknown function of the file /php/api_patient_schedule.php. This manipulation of the argument appointmentID caus…
CVE-2025-13247CRITICALCVSS 9.8EG 9.8
2025-11-16
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /admin/user-bookings.php. The manipulation of the argument uid results in sql injection. It is possibl…
CVE-2025-13242CRITICALCVSS 9.8EG 9.8
2025-11-16
A vulnerability has been found in code-projects Student Information System 2.0. This issue affects some unknown processing of the file /register.php. The manipulation leads to sql injection. The attack is possible to be carried out remotel…
CVE-2025-13241CRITICALCVSS 9.8EG 9.8
2025-11-16
A flaw has been found in code-projects Student Information System 2.0. This vulnerability affects unknown code of the file /index.php. Executing manipulation of the argument Username can lead to sql injection. The attack can be executed re…
CVE-2025-13240CRITICALCVSS 9.8EG 9.8
2025-11-16
A vulnerability was detected in code-projects Student Information System 2.0. This affects an unknown part of the file /searchquery.php. Performing manipulation of the argument s results in sql injection. Remote exploitation of the attack …
CVE-2025-13237CRITICALCVSS 9.8EG 9.8
2025-11-16
A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Affected is an unknown function of the file /LogSignModal.PHP. The manipulation of the argument U_USERNAME results in sql injection. The attack can be lau…
CVE-2025-13236CRITICALCVSS 9.8EG 9.8
2025-11-16
A vulnerability was identified in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be…
CVE-2025-13235CRITICALCVSS 9.8EG 9.8
2025-11-16
A vulnerability was determined in itsourcecode Inventory Management System 1.0. This affects an unknown function of the file /admin/login.php. Executing manipulation of the argument user_email can lead to sql injection. It is possible to l…
CVE-2025-13234CRITICALCVSS 9.8EG 9.8
2025-11-16
A vulnerability was found in itsourcecode Inventory Management System 1.0. The impacted element is an unknown function of the file /index.php?q=product. Performing manipulation of the argument PROID results in sql injection. It is possible…
CVE-2025-13233CRITICALCVSS 9.8EG 9.8
2025-11-16
A vulnerability has been found in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /index.php?q=single-item. Such manipulation of the argument ID leads to sql injection. The attack may b…
CVE-2025-13210CRITICALCVSS 9.8EG 9.8
2025-11-15
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=add. Such manipulation of the argument PROMODEL leads to sql injection.…
CVE-2025-13203CRITICALCVSS 9.8EG 9.8
2025-11-15
A weakness has been identified in code-projects Simple Cafe Ordering System 1.0. This vulnerability affects unknown code of the file /addmem.php. Executing manipulation of the argument studentnum can lead to sql injection. It is possible t…
CVE-2025-13201CRITICALCVSS 9.8EG 9.8
2025-11-15
A vulnerability was identified in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Username leads to sql injection. The attack may…
CVE-2025-13170CRITICALCVSS 9.8EG 9.8
2025-11-14
A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/edit_account.php. Performing a manipulation of the argument admin_id results in sql inj…
CVE-2025-13169CRITICALCVSS 9.8EG 9.8
2025-11-14
A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /add_query_reserve.php. Such manipulation of the argument room_id leads to sql inje…
CVE-2025-13168CRITICALCVSS 9.8EG 9.8
2025-11-14
A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation o…
CVE-2025-13123CRITICALCVSS 9.8EG 9.8
2025-11-13
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Executing manipulation of the argument uid can lead to sql injection. It is possibl…
CVE-2025-13122CRITICALCVSS 9.8EG 9.8
2025-11-13
A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of the file /php/api_patient_checkin.php. Performing manipulation of the argument …
CVE-2025-64741CRITICALCVSS 9.8EG 9.8
2025-11-13
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2025-13076CRITICALCVSS 9.8EG 9.8
2025-11-12
A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing manipulation of the argument usname can lead to sql injection. The attack can be ex…
CVE-2025-13075CRITICALCVSS 9.8EG 9.8
2025-11-12
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing manipulation of the argument eid results in sql injection. Remote exploitation of th…
CVE-2025-13060CRITICALCVSS 9.8EG 9.8
2025-11-12
A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such manipulation of the argument ID leads to sql injection. The attack can be execu…
CVE-2025-13059CRITICALCVSS 9.8EG 9.8
2025-11-12
A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This manipulation of the argument ID causes sql injection. Remote exploitation of th…
CVE-2025-13057CRITICALCVSS 9.8EG 9.8
2025-11-12
A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be…
CVE-2025-12939CRITICALCVSS 9.8EG 9.8
2025-11-10
A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /addCandidate.php. The manipulation of the argument candName results in sql injec…
CVE-2025-12938CRITICALCVSS 9.8EG 9.8
2025-11-10
A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_login.php. The manipulation of the argument keywords leads to sql injection. The a…
CVE-2025-12933CRITICALCVSS 9.8EG 9.8
2025-11-10
A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcome. Such manipulation of the argument roleid leads to sql injection. The attack c…
CVE-2025-12932CRITICALCVSS 9.8EG 9.8
2025-11-10
A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. This manipulation of the argument msgid causes sql injection. The attack can be in…
CVE-2025-12931CRITICALCVSS 9.8EG 9.8
2025-11-10
A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orders.php. The manipulation of the argument ID results in sql injection. It is poss…
CVE-2025-12930CRITICALCVSS 9.8EG 9.8
2025-11-10
A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remo…
CVE-2025-12929CRITICALCVSS 9.8EG 9.8
2025-11-10
A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Executing manipulation of the argument fullname can lead to sql injection. The attac…
CVE-2025-12928CRITICALCVSS 9.8EG 9.8
2025-11-10
A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument username/phone results in sql injection. The attack is possible to…
CVE-2025-12916CRITICALCVSS 9.8EG 9.8
2025-11-09
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes…
CVE-2025-12913CRITICALCVSS 9.8EG 9.8
2025-11-08
A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotel…
CVE-2025-12873CRITICALCVSS 9.8EG 9.8
2025-11-07
A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initi…
CVE-2025-12857CRITICALCVSS 9.8EG 9.8
2025-11-07
A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook.php. Such manipulation of the argument rid leads to sql injection. The attack ca…
CVE-2025-12856CRITICALCVSS 9.8EG 9.8
2025-11-07
A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulation of the argument email causes sql injection. The attack can be initiated remote…
CVE-2025-12855CRITICALCVSS 9.8EG 9.8
2025-11-07
A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php. The manipulation of the argument eid results in sql injection. It is possible …

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →