CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,064 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 12 of 122

CVE-2025-12853CRITICALCVSS 9.8EG 9.8
2025-11-07
A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack …
CVE-2025-12617CRITICALCVSS 9.8EG 9.8
2025-11-03
A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the att…
CVE-2025-12614CRITICALCVSS 9.8EG 9.8
2025-11-03
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. The attack is possib…
CVE-2025-12612CRITICALCVSS 9.8EG 9.8
2025-11-03
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_course. The manipulation of the argument ID results in sql injection…
CVE-2025-12608CRITICALCVSS 9.8EG 9.8
2025-11-03
A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attac…
CVE-2025-12607CRITICALCVSS 9.8EG 9.8
2025-11-03
A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remo…
CVE-2025-12606CRITICALCVSS 9.8EG 9.8
2025-11-03
A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php. This manipulation of the argument ID causes sql injection. Remote exploitation o…
CVE-2025-12605CRITICALCVSS 9.8EG 9.8
2025-11-02
A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipulation of the argument ID results in sql injection. The attack may be launched rem…
CVE-2025-12604CRITICALCVSS 9.8EG 9.8
2025-11-02
A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation of the argument loan_id leads to sql injection. The attack may be initiated remot…
CVE-2025-12598CRITICALCVSS 9.8EG 9.8
2025-11-02
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. T…
CVE-2025-12597CRITICALCVSS 9.8EG 9.8
2025-11-02
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the file /admin_class.php. Performing manipulation of the argument Name results in sql …
CVE-2025-12339CRITICALCVSS 9.8EG 9.8
2025-10-28
A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection.…
CVE-2025-12338CRITICALCVSS 9.8EG 9.8
2025-10-28
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.ph. Executing a manipulation of the argument pid can lead to sql injection. The a…
CVE-2025-12337CRITICALCVSS 9.8EG 9.8
2025-10-28
A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Performing a manipulation of the argument pid results in sql injection. The attack…
CVE-2025-12336CRITICALCVSS 9.8EG 9.8
2025-10-28
A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_index.php. Such manipulation of the argument Username leads to sql injection…
CVE-2025-12325CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initia…
CVE-2025-12316CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The manipulation of the argument OfficeName leads to sql injection. The attack is possib…
CVE-2025-12315CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulation of the argument itemPrice can lead to sql injection. The attack can be execute…
CVE-2025-12314CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitat…
CVE-2025-12313CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launche…
CVE-2025-12309CRITICALCVSS 9.8EG 9.8
2025-10-27
A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the…
CVE-2025-12308CRITICALCVSS 9.8EG 9.8
2025-10-27
A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql in…
CVE-2025-12307CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack…
CVE-2025-12306CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried…
CVE-2025-12294CRITICALCVSS 9.8EG 9.8
2025-10-27
A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated re…
CVE-2025-12293CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the atta…
CVE-2025-12292CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack rem…
CVE-2025-12257CRITICALCVSS 9.8EG 9.8
2025-10-27
A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attack …
CVE-2025-12253CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injectio…
CVE-2025-12237CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulation of the argument keywords leads to sql injection. The attack can be executed r…
CVE-2025-12226CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. Remote exploi…
CVE-2025-12215CRITICALCVSS 9.8EG 9.8
2025-10-27
A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remot…
CVE-2025-12208CRITICALCVSS 9.8EG 9.8
2025-10-27
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is po…
CVE-2025-11736CRITICALCVSS 9.8EG 9.8
2025-10-14
A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate t…
CVE-2025-11664CRITICALCVSS 9.8EG 9.8
2025-10-13
A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /admin/search-appointment.php. Such manipulation of the argument searchdata leads t…
CVE-2025-11662CRITICALCVSS 9.8EG 9.8
2025-10-13
A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulation of the argument serv_id results in sql injection. It is possible to launch t…
CVE-2025-11629CRITICALCVSS 9.8EG 9.8
2025-10-12
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit …
CVE-2025-11615CRITICALCVSS 9.8EG 9.8
2025-10-11
A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exp…
CVE-2025-11614CRITICALCVSS 9.8EG 9.8
2025-10-11
A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit-appointment.php. Such manipulation of the argument editid leads to sql injectio…
CVE-2025-11608CRITICALCVSS 9.8EG 9.8
2025-10-11
A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component POST Parameter Handler. The manipulation of the argument username/password leads …
CVE-2025-11604CRITICALCVSS 9.8EG 9.8
2025-10-11
A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of …
CVE-2025-11601CRITICALCVSS 9.8EG 9.8
2025-10-11
A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. …
CVE-2025-11599CRITICALCVSS 9.8EG 9.8
2025-10-11
A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php. This manipulation of the argument email causes sql injection. It is possible to …
CVE-2025-11597CRITICALCVSS 9.8EG 9.8
2025-10-11
A vulnerability was identified in code-projects E-Commerce Website 1.0. The impacted element is an unknown function of the file /pages/product_add_qty.php. The manipulation of the argument prod_id leads to sql injection. The attack is poss…
CVE-2025-11596CRITICALCVSS 9.8EG 9.8
2025-10-11
A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php. Executing manipulation of the argument order_id can lead to sql injection. The…
CVE-2025-11595CRITICALCVSS 9.8EG 9.8
2025-10-11
A vulnerability was found in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /admin-profile.php. Performing a manipulation of the argument mobilenumber results in sql injection. Remote …
CVE-2025-11585CRITICALCVSS 9.8EG 9.8
2025-10-10
A vulnerability was found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /useredit.php. The manipulation of the argument uid results in sql injection. The attack can be executed remo…
CVE-2025-11584CRITICALCVSS 9.8EG 9.8
2025-10-10
A vulnerability has been found in code-projects Online Job Search Engine 1.0. The affected element is an unknown function of the file /searchjob.php. The manipulation of the argument txtspecialization leads to sql injection. Remote exploit…
CVE-2025-11583CRITICALCVSS 9.8EG 9.8
2025-10-10
A flaw has been found in code-projects Online Job Search Engine 1.0. Impacted is an unknown function of the file /postjob.php. Executing manipulation of the argument txtjobID can lead to sql injection. The attack may be launched remotely. …
CVE-2025-11582CRITICALCVSS 9.8EG 9.8
2025-10-10
A vulnerability was detected in code-projects Online Job Search Engine 1.0. This issue affects some unknown processing of the file /registration.php. Performing manipulation of the argument txtusername results in sql injection. The attack …

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →