CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,216 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 76 of 105

CVE-2025-8154MEDIUMCVSS 5.3EG 5.3
2026-05-11
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a m…
CVE-2025-8156HIGHCVSS 7.2EG 7.2
2025-07-25
A vulnerability was found in PHPGurukul User Registration & Login and User Management 3.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/lastsevendays-reg-users.php. The manipulation of …
CVE-2025-8157HIGHCVSS 7.2EG 7.2
2025-07-25
A vulnerability was found in PHPGurukul User Registration & Login and User Management 3.3. It has been classified as critical. This affects an unknown part of the file /admin/lastthirtyays-reg-users.php. The manipulation of the argument ID…
CVE-2025-8158HIGHCVSS 7.2EG 7.2
2025-07-25
A vulnerability was found in PHPGurukul Login and User Management System 3.3. It has been declared as critical. This vulnerability affects unknown code of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads t…
CVE-2025-8161HIGHCVSS 8.8EG 8.8
2025-07-25
A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. Affected by this vulnerability is an unknown functionality of the file /system/role/export. The manipulation of the argument params[dataScope] leads to sql i…
CVE-2025-8162HIGHCVSS 8.8EG 8.8
2025-07-25
A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the file /system/dept/list. The manipulation of the argument params[dataScope] leads…
CVE-2025-8163HIGHCVSS 8.8EG 8.8
2025-07-25
A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/role/list. The manipulation of the argument params[dataScope] leads to sql injection. It is poss…
CVE-2025-8164HIGHCVSS 8.8EG 8.8
2025-07-25
A vulnerability has been found in code-projects Public Chat Room 1.0 and classified as critical. This vulnerability affects unknown code of the file send_message.php. The manipulation of the argument ID leads to sql injection. The attack c…
CVE-2025-8165HIGHCVSS 8.8EG 8.8
2025-07-25
A vulnerability was found in code-projects Food Review System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/approve_reservation.php. The manipulation of the argument occasion leads to sql inj…
CVE-2025-8166CRITICALCVSS 9.8EG 9.8
2025-07-25
A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/index.php of the component HTTP POST Request Handler. The manipulation of the arg…
CVE-2025-8172HIGHCVSS 8.8EG 8.8
2025-07-25
A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It…
CVE-2025-8173CRITICALCVSS 9.8EG 9.8
2025-07-25
A vulnerability has been found in 1000 Projects ABC Courier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /Add_reciver.php. The manipulation of the argument reciver…
CVE-2025-8179CRITICALCVSS 9.8EG 9.8
2025-07-26
A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/changeimage.php. The manipulation of the argum…
CVE-2025-8185CRITICALCVSS 9.8EG 9.8
2025-07-26
A vulnerability was found in 1000 Projects ABC Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /getbyid.php. The manipulation of the argument ID leads to sql injection. It is p…
CVE-2025-8186HIGHCVSS 8.8EG 8.8
2025-07-26
A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit_branch.php. The manipulation of the argument ID leads to s…
CVE-2025-8187HIGHCVSS 8.8EG 8.8
2025-07-26
A vulnerability was found in Campcodes Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /edit_parcel.php. The manipulation of the argument ID leads to sql inject…
CVE-2025-8188HIGHCVSS 8.8EG 8.8
2025-07-26
A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /edit_staff.php. The manipulation of the argument ID leads to sql injection. It is possible to initi…
CVE-2025-8189HIGHCVSS 8.8EG 8.8
2025-07-26
A vulnerability classified as critical was found in Campcodes Courier Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php. The manipulation of the argument ID leads to sql injection. The attack can be …
CVE-2025-8190HIGHCVSS 8.8EG 8.8
2025-07-26
A vulnerability, which was classified as critical, has been found in Campcodes Courier Management System 1.0. This issue affects some unknown processing of the file /print_pdets.php. The manipulation of the argument ids leads to sql inject…
CVE-2025-8203CRITICALCVSS 9.8EG 9.8
2025-07-26
A vulnerability classified as critical has been found in Jingmen Zeyou Large File Upload Control up to 6.3. Affected is an unknown function of the file /index.jsp. The manipulation of the argument ID leads to sql injection. It is possible …
CVE-2025-8219CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php of the co…
CVE-2025-8220CRITICALCVSS 9.4EG 9.4
2025-07-27
A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of…
CVE-2025-8229HIGHCVSS 8.8EG 8.8
2025-07-27
A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /parcel_list.php. The manipulation of the argument s leads to sql injection. It is possible to initi…
CVE-2025-8230HIGHCVSS 8.8EG 8.8
2025-07-27
A vulnerability classified as critical was found in Campcodes Courier Management System 1.0. This vulnerability affects unknown code of the file /manage_user.php. The manipulation of the argument ID leads to sql injection. The attack can b…
CVE-2025-8232CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability, which was classified as critical, was found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/delete_user.php. The manipulation of the argument ID leads to sql injection. It is…
CVE-2025-8233CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability has been found in code-projects Online Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/user.php. The manipulation of the argument un leads to sql…
CVE-2025-8234CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability was found in code-projects Online Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_member.php. The manipulation of the argument ID leads to sql i…
CVE-2025-8235CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability was found in code-projects Online Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/product.php. The manipulation of the argument Name leads to sql injection. It is pos…
CVE-2025-8236CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability was found in code-projects Online Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit_product.php. The manipulation of the argument Name leads to sql inject…
CVE-2025-8237CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/update_s1.php. The manipulation of the argument credits leads to sql injectio…
CVE-2025-8238CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s2.php. The manipulation of the argument credits leads to sql injection. It is possi…
CVE-2025-8239CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument email leads to sql injection. The …
CVE-2025-8240CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /user/dashboard.php. The manipulation of the argument phone leads…
CVE-2025-8241CRITICALCVSS 9.8EG 9.8
2025-07-27
A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. This affects an unknown part of the file /report.php. The manipulation of the argument From leads to sql injection. It is poss…
CVE-2025-8247HIGHCVSS 8.8EG 8.8
2025-07-28
A vulnerability classified as critical has been found in Projectworlds Online Admission System 1.0. This affects an unknown part of the file /admin.php. The manipulation of the argument markof leads to sql injection. It is possible to init…
CVE-2025-8248CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability classified as critical was found in code-projects Online Ordering System 1.0. This vulnerability affects unknown code of the file /signup.php. The manipulation of the argument firstname leads to sql injection. The attack ca…
CVE-2025-8249CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s3.php. The manipulation of the argument credits leads to sql…
CVE-2025-8250CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability, which was classified as critical, was found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s4.php. The manipulation of the argument credits leads to sql injection. It i…
CVE-2025-8251CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s4.php. The manipulation of the argument ID leads to …
CVE-2025-8252CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s5.php. The manipulation of the argument ID leads to sql injecti…
CVE-2025-8253CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s6.php. The manipulation of the argument ID leads to sql injection. It is possi…
CVE-2025-8254CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view_parcel.php. The manipulation of the argument ID leads to sql injection. The a…
CVE-2025-8269CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s1.php. The manipulation of the argument ID leads to sql injecti…
CVE-2025-8270CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s2.php. The manipulation of the argument ID leads to sql injection. It is possi…
CVE-2025-8271CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_s3.php. The manipulation of the argument ID leads to sql injection. Th…
CVE-2025-8272CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/update_fst.php. The manipulation of the argument credits leads to sql injecti…
CVE-2025-8273CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s8.php. The manipulation of the argument credits leads to sql injection. It is possi…
CVE-2025-8274CRITICALCVSS 9.8EG 9.8
2025-07-28
A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=save_recruitment_status. The manipulation…
CVE-2025-8276CRITICALCVSS 9.8EG 10.0
2025-09-16
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulner…
CVE-2025-8326CRITICALCVSS 9.8EG 9.8
2025-07-30
A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/delete_s7.php. The manipulation of the argument ID leads to sql injection. It is possible t…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →