CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,063 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 6 of 122

CVE-2026-2161CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-password.php. The manipulation of the argument email results in sql injection. The at…
CVE-2026-2158CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the…
CVE-2026-2136CRITICALCVSS 9.8EG 9.8
2026-02-08
A flaw has been found in projectworlds Online Food Ordering System 1.0. This affects an unknown function of the file /view-ticket.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the atta…
CVE-2026-2132CRITICALCVSS 9.8EG 9.8
2026-02-08
A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpdateCategory.php. The manipulation of the argument txtcat results in sql injection…
CVE-2026-2130CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username. Executing a manipulation of the argument Username can lead to command injectio…
CVE-2026-2122CRITICALCVSS 9.8EG 9.8
2026-02-08
A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The manipulation of the argument ID results in sql injection. The attack may be launc…
CVE-2026-2117CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability was found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/edit_activity.php. Performing a manipulation of the argument activity_id results in sql injection. The …
CVE-2026-2116CRITICALCVSS 9.8EG 9.8
2026-02-08
A vulnerability has been found in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/edit_expenses.php. Such manipulation of the argument expenses_id leads to sql injection. It is possible to lau…
CVE-2026-2115CRITICALCVSS 9.8EG 9.8
2026-02-07
A flaw has been found in itsourcecode Society Management System 1.0. This issue affects some unknown processing of the file /admin/delete_expenses.php. This manipulation of the argument expenses_id causes sql injection. It is possible to i…
CVE-2026-2114CRITICALCVSS 9.8EG 9.8
2026-02-07
A vulnerability was detected in itsourcecode Society Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_admin.php. The manipulation of the argument admin_id results in sql injection. The attack may be pe…
CVE-2026-2090CRITICALCVSS 9.8EG 9.8
2026-02-07
A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.php. Executing a manipulation of the argument term can lead to sql injection. The…
CVE-2026-2089CRITICALCVSS 9.8EG 9.8
2026-02-07
A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. Remote ex…
CVE-2026-2088CRITICALCVSS 9.8EG 9.8
2026-02-07
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-appointment.php. Such manipulation of the argument delid leads to sql injection. The attack may be …
CVE-2026-2087CRITICALCVSS 9.8EG 9.8
2026-02-07
A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This manipulation of the argument user_email causes sql injection. The attack may be…
CVE-2026-2083CRITICALCVSS 9.8EG 9.8
2026-02-07
A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initia…
CVE-2026-2073CRITICALCVSS 9.8EG 9.8
2026-02-07
A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be pe…
CVE-2026-2060CRITICALCVSS 9.8EG 9.8
2026-02-06
A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /simpleblooddonor/editcampaignform.php. Performing a manipulation of the argument I…
CVE-2026-2059CRITICALCVSS 9.8EG 9.8
2026-02-06
A vulnerability has been found in SourceCodester Medical Center Portal Management System 1.0. Affected is an unknown function of the file /emp_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be perfor…
CVE-2026-2058CRITICALCVSS 9.8EG 9.8
2026-02-06
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /postquerypublic.php of the component Post Query Details Page. This manipulation …
CVE-2026-2057CRITICALCVSS 9.8EG 9.8
2026-02-06
A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipulation of the argument User results in sql injection. The attack can be executed…
CVE-2026-2018CRITICALCVSS 9.8EG 9.8
2026-02-06
A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attac…
CVE-2026-2014CRITICALCVSS 9.8EG 9.8
2026-02-06
A security flaw has been discovered in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /ramonsys/billing/index.php. Performing a manipulation of the argument ID results in sql injection. Remote expl…
CVE-2026-2013CRITICALCVSS 9.8EG 9.8
2026-02-06
A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched rem…
CVE-2026-2012CRITICALCVSS 9.8EG 9.8
2026-02-06
A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonsys/facultyloading/index.php. This manipulation of the argument ID causes sql injection. The attack…
CVE-2026-2011CRITICALCVSS 9.8EG 9.8
2026-02-06
A vulnerability was found in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /ramonsys/enrollment/controller.php. The manipulation of the argument ID results in sql injection. The attack …
CVE-2026-1701CRITICALCVSS 9.8EG 9.8
2026-01-30
A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown processing of the file /enrollment/index.php. Such manipulation of the argument ID leads to sql injection. It is possi…
CVE-2026-1688CRITICALCVSS 9.8EG 9.8
2026-01-30
A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The att…
CVE-2026-1595CRITICALCVSS 9.8EG 9.8
2026-01-29
A vulnerability was detected in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_student_query.php. The manipulation of the argument student_id results in sql injection. The attack can be exe…
CVE-2026-1594CRITICALCVSS 9.8EG 9.8
2026-01-29
A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add_expenses.php. The manipulation of the argument detail leads to sql inject…
CVE-2026-1593CRITICALCVSS 9.8EG 9.8
2026-01-29
A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_expenses_query.php. Executing a manipulation of the argument detail can lead t…
CVE-2026-1590CRITICALCVSS 9.8EG 9.8
2026-01-29
A vulnerability was identified in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/faculty/index.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched …
CVE-2026-1589CRITICALCVSS 9.8EG 9.8
2026-01-29
A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/inquiry/index.php. This manipulation of the argument txtsearch causes sql injection. The attack can be init…
CVE-2026-1552CRITICALCVSS 9.8EG 9.8
2026-01-29
A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to sql injection. The attack is possible to be carried out remo…
CVE-2026-1547CRITICALCVSS 9.8EG 9.8
2026-01-28
A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch t…
CVE-2026-1546CRITICALCVSS 9.8EG 9.8
2026-01-28
A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItem…
CVE-2026-1545CRITICALCVSS 9.8EG 9.8
2026-01-28
A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may b…
CVE-2026-1535CRITICALCVSS 9.8EG 9.8
2026-01-28
A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible …
CVE-2026-1534CRITICALCVSS 9.8EG 9.8
2026-01-28
A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the argument ID causes sql injection. It is possible to initiate…
CVE-2026-1533CRITICALCVSS 9.8EG 9.8
2026-01-28
A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The manipulation results in sql injection. The attack may be perfo…
CVE-2026-1443CRITICALCVSS 9.8EG 9.8
2026-01-26
A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack ca…
CVE-2026-1422CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results…
CVE-2026-1414CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Execut…
CVE-2026-1413CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performi…
CVE-2026-1412CRITICALCVSS 9.8EG 9.8
2026-01-26
A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such …
CVE-2026-1179CRITICALCVSS 9.8EG 9.8
2026-01-19
A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid results in sql injection. The attack can…
CVE-2026-1178CRITICALCVSS 9.8EG 9.8
2026-01-19
A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to…
CVE-2026-1177CRITICALCVSS 9.8EG 9.8
2026-01-19
A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid c…
CVE-2026-1176CRITICALCVSS 9.8EG 9.8
2026-01-19
A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a manipulation of the argument ID results in sql injection. It is possible to init…
CVE-2026-1160CRITICALCVSS 9.8EG 9.8
2026-01-19
A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipulation of the argument searchdata leads to sql injection. T…
CVE-2026-1159CRITICALCVSS 9.8EG 9.8
2026-01-19
A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.php. Executing a manipulation of the argument product_name can lead to sql injecti…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →