CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,063 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 5 of 122

CVE-2026-3406CRITICALCVSS 9.8EG 9.8
2026-03-02
A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results i…
CVE-2026-3395CRITICALCVSS 9.8EG 9.8
2026-03-01
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can l…
CVE-2026-3287CRITICALCVSS 9.8EG 9.8
2026-02-27
A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java of the component App-side P…
CVE-2026-3261CRITICALCVSS 9.8EG 9.8
2026-02-26
A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting Handler. This manipulation of the argument ID causes sql injection. The attack ma…
CVE-2026-27727CRITICALCVSS 9.8EG 9.8
2026-02-25
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked w…
CVE-2026-3164CRITICALCVSS 9.8EG 9.8
2026-02-25
A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulation of the argument pagetitle results in sql injection. It is possible to launch t…
CVE-2026-3153CRITICALCVSS 9.8EG 9.8
2026-02-25
A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attac…
CVE-2026-3152CRITICALCVSS 9.8EG 9.8
2026-02-25
A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This manipulation of the argument teacher_id causes sql injection. It is possible to ini…
CVE-2026-3151CRITICALCVSS 9.8EG 9.8
2026-02-25
A vulnerability was detected in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /login/login.php. The manipulation of the argument email results in sql injection. The attack may be performed …
CVE-2026-3148CRITICALCVSS 9.8EG 9.8
2026-02-25
A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manipulation of the argument Username causes sql injection. The attack may be initiat…
CVE-2026-3135CRITICALCVSS 9.8EG 9.8
2026-02-25
A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to ini…
CVE-2026-3134CRITICALCVSS 9.8EG 9.8
2026-02-25
A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. T…
CVE-2026-3133CRITICALCVSS 9.8EG 9.8
2026-02-25
A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the component Login. The manipulation of the argument Username leads to sql injection. Rem…
CVE-2026-3069CRITICALCVSS 9.8EG 9.8
2026-02-24
A security vulnerability has been detected in itsourcecode Document Management System 1.0. Affected is an unknown function of the file /edtlbls.php. The manipulation of the argument field1 leads to sql injection. The attack may be initiate…
CVE-2026-3068CRITICALCVSS 9.8EG 9.8
2026-02-24
A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launch…
CVE-2026-3057CRITICALCVSS 9.8EG 9.8
2026-02-24
A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument p…
CVE-2026-3046CRITICALCVSS 9.8EG 9.8
2026-02-24
A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id le…
CVE-2026-3042CRITICALCVSS 9.8EG 9.8
2026-02-24
A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possib…
CVE-2026-2954CRITICALCVSS 9.8EG 9.8
2026-02-22
A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassNa…
CVE-2026-2912CRITICALCVSS 9.8EG 9.8
2026-02-22
A vulnerability was found in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/students/assessments/results/studentresult-view.php. The manipulation of the argument test_id results in sql …
CVE-2026-2867CRITICALCVSS 9.8EG 9.8
2026-02-21
A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched re…
CVE-2026-2865CRITICALCVSS 9.8EG 9.8
2026-02-21
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argume…
CVE-2026-27194CRITICALCVSS 9.8EG 9.8
2026-02-21
D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing…
CVE-2026-2848CRITICALCVSS 9.8EG 9.8
2026-02-20
A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the ar…
CVE-2026-2691CRITICALCVSS 9.8EG 9.8
2026-02-19
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is pos…
CVE-2026-2690CRITICALCVSS 9.8EG 9.8
2026-02-19
A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username…
CVE-2026-2689CRITICALCVSS 9.8EG 9.8
2026-02-19
A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from…
CVE-2026-2682CRITICALCVSS 9.8EG 9.8
2026-02-18
A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid lead…
CVE-2026-2529CRITICALCVSS 9.8EG 9.8
2026-02-16
A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list results in command injection. The at…
CVE-2026-2528CRITICALCVSS 9.8EG 9.8
2026-02-16
A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to command injection.…
CVE-2026-2527CRITICALCVSS 9.8EG 9.8
2026-02-16
A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched rem…
CVE-2026-25814CRITICALCVSS 9.8EG 9.8
2026-02-09
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
CVE-2026-2225CRITICALCVSS 9.8EG 9.8
2026-02-09
A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admin/index.php of the component Administrator Login. This manipulation of the argument email causes sql injection. The att…
CVE-2026-2223CRITICALCVSS 9.8EG 9.8
2026-02-09
A security vulnerability has been detected in code-projects Online Reviewer System 1.0. Affected by this issue is some unknown functionality of the file /system/system/students/assessments/pretest/take/index.php. The manipulation of the ar…
CVE-2026-2221CRITICALCVSS 9.8EG 9.8
2026-02-09
A security flaw has been discovered in code-projects Online Reviewer System 1.0. Affected is an unknown function of the file /login/index.php of the component Login. Performing a manipulation of the argument Username results in sql injecti…
CVE-2026-2220CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pretest/btn_functions.php. Such manipulation of the argument difficulty_id leads to …
CVE-2026-2217CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The manipulation of the argument ID results in sql injection. The attack may be launched…
CVE-2026-2212CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /Administrator/PHP/AdminEditCategory.php. The manipulation of the argument ID leads to sql inject…
CVE-2026-2211CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDeleteCategory.php. Executing a manipulation of the argument ID can lead to sql injection. The attac…
CVE-2026-2199CRITICALCVSS 9.8EG 9.8
2026-02-09
A security flaw has been discovered in code-projects Online Reviewer System 1.0. The impacted element is an unknown function of the file /reviewer/system/system/admins/manage/users/user-delete.php. Performing a manipulation of the argument…
CVE-2026-2198CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/assessments/pretest/loaddata.php. Such manipulation of the argument difficulty_id lea…
CVE-2026-2197CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/pretest/exam-delete.php. This manipulation of the argument test_id causes sql injecti…
CVE-2026-2196CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments/pretest/exam-update.php. The manipulation of the argument test_id results in sq…
CVE-2026-2195CRITICALCVSS 9.8EG 9.8
2026-02-09
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /system/system/admins/assessments/pretest/questions-view.php. The manipulation of the argument ID leads to sql …
CVE-2026-2190CRITICALCVSS 9.8EG 9.8
2026-02-08
A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. The manipulation of the argument ID results in sql injection. The attack can be l…
CVE-2026-2189CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manipulation of the argument ay leads to sql injection. The attack can be initiated r…
CVE-2026-2173CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attac…
CVE-2026-2172CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown functionality of the file enrollment/index.php of the component Login Endpoint. Executing a manipulat…
CVE-2026-2171CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of the component Login. Performing a manipulation of the argument username/password results in sql in…
CVE-2026-2166CRITICALCVSS 9.8EG 9.8
2026-02-08
A security vulnerability has been detected in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /login/index.php of the component Login. The manipulation of the argument username/password lea…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →