CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

6,063 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 8 of 122

CVE-2025-15420CRITICALCVSS 9.8EG 9.8
2026-01-02
A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The…
CVE-2025-15410CRITICALCVSS 9.8EG 9.8
2026-01-01
A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument L_email leads to sql injection. It is possible to initia…
CVE-2025-15409CRITICALCVSS 9.8EG 9.8
2026-01-01
A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Delete_product.php. Executing a manipulation of the argument del_pro can lead to sql inj…
CVE-2025-15408CRITICALCVSS 9.8EG 9.8
2026-01-01
A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing a manipulation of the argument dre_title results in sql injection. The attack is possible…
CVE-2025-15407CRITICALCVSS 9.8EG 9.8
2026-01-01
A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. Such manipulation of the argument dre_Ctitle leads to sql injection. The attack can be execut…
CVE-2026-0544CRITICALCVSS 9.8EG 9.8
2026-01-01
A security flaw has been discovered in itsourcecode School Management System 1.0. This affects an unknown part of the file /student/index.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attac…
CVE-2025-15391CRITICALCVSS 9.8EG 9.8
2025-12-31
A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been…
CVE-2025-15243CRITICALCVSS 9.8EG 9.8
2025-12-30
A flaw has been found in code-projects Simple Stock System 1.0. This affects an unknown function of the file /market/login.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotel…
CVE-2025-15212CRITICALCVSS 9.8EG 9.8
2025-12-30
A vulnerability was detected in code-projects Refugee Food Management System 1.0. This issue affects some unknown processing of the file /home/regfood.php. Performing manipulation of the argument a results in sql injection. Remote exploita…
CVE-2025-15211CRITICALCVSS 9.8EG 9.8
2025-12-30
A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to …
CVE-2025-15210CRITICALCVSS 9.8EG 9.8
2025-12-30
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This vulnerability affects unknown code of the file /home/editrefugee.php. Such manipulation of the argument a/b/c/sex/d/e/nationality_nid lead…
CVE-2025-15209CRITICALCVSS 9.8EG 9.8
2025-12-29
A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulation of the argument a/b/c/d causes sql injection. The attack may be initiated re…
CVE-2025-15208CRITICALCVSS 9.8EG 9.8
2025-12-29
A security flaw has been discovered in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/editrefugee.php. The manipulation of the argument rfid results in sql injection…
CVE-2025-15207CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/view_products.php. The manipulation of the argument chkId[] leads to sql injection. It is possible to initiate t…
CVE-2025-15206CRITICALCVSS 9.8EG 9.8
2025-12-29
A flaw has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /admin/add_area.php. Executing a manipulation of the argument txtAreaCode can lead to sql injection. The attack may be performe…
CVE-2025-15198CRITICALCVSS 9.8EG 9.8
2025-12-29
A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /login.php. Executing a manipulation of the argument User can lead to sql injection. The attack may …
CVE-2025-15196CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploi…
CVE-2025-15195CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.php. This manipulation of the argument linked[] causes sql injection. The attack …
CVE-2025-15186CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability has been found in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/addusers.php. Such manipulation of the argument a leads to sql injection. It is poss…
CVE-2025-15185CRITICALCVSS 9.8EG 9.8
2025-12-29
A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugeesreport.php. This manipulation of the argument a causes sql injection. It is pos…
CVE-2025-15184CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability was detected in code-projects Refugee Food Management System 1.0. Affected is an unknown function of the file /home/refugeesreport2.php. The manipulation of the argument a results in sql injection. The attack may be perform…
CVE-2025-15183CRITICALCVSS 9.8EG 9.8
2025-12-29
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This impacts an unknown function of the file /home/viewtakenfd.php. The manipulation of the argument tfid leads to sql injection. The attack is…
CVE-2025-15182CRITICALCVSS 9.8EG 9.8
2025-12-29
A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown function of the file /home/served.php. Executing manipulation of the argument refNo can lead to sql injection. The attack can be ex…
CVE-2025-15181CRITICALCVSS 9.8EG 9.8
2025-12-29
A security flaw has been discovered in code-projects Refugee Food Management System 1.0. The impacted element is an unknown function of the file /home/pagenateRefugeesList.php. Performing manipulation of the argument rfid results in sql in…
CVE-2025-15168CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability was identified in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /statistical.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. T…
CVE-2025-15167CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /detailtransac.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack i…
CVE-2025-15166CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The manipulation of the argument ID results in sql injection. The attack may be launch…
CVE-2025-15165CRITICALCVSS 9.8EG 9.8
2025-12-29
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. The impacted element is an unknown function of the file /updatecustomer.php?action=edit. The manipulation of the argument ID leads to sql injection. The attack…
CVE-2025-15127CRITICALCVSS 9.8EG 9.8
2025-12-28
A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown functionality of the file /controller/api/Room.php. Such manipulation of the ar…
CVE-2025-15078CRITICALCVSS 9.8EG 9.8
2025-12-25
A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manipulation of the argument sy results in sql injection. The attack may be launched …
CVE-2025-15077CRITICALCVSS 9.8EG 9.8
2025-12-25
A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php. The manipulation of the argument ID leads to sql injection. The attack may be i…
CVE-2025-15075CRITICALCVSS 9.8EG 9.8
2025-12-25
A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Performing manipulation of the argument ID results in sql injection. The attack can b…
CVE-2025-15074CRITICALCVSS 9.8EG 9.8
2025-12-25
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attac…
CVE-2025-15073CRITICALCVSS 9.8EG 9.8
2025-12-24
A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the a…
CVE-2025-15049CRITICALCVSS 9.8EG 9.8
2025-12-23
A vulnerability was identified in code-projects Online Farm System 1.0. Affected is an unknown function of the file /addProduct.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. Th…
CVE-2025-15048CRITICALCVSS 9.8EG 9.8
2025-12-23
A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection…
CVE-2025-15034CRITICALCVSS 9.8EG 9.8
2025-12-23
A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The…
CVE-2025-15012CRITICALCVSS 9.8EG 9.8
2025-12-22
A vulnerability was determined in code-projects Refugee Food Management System 1.0. The affected element is an unknown function of the file /home/home.php. This manipulation of the argument a causes sql injection. The attack is possible to…
CVE-2025-15011CRITICALCVSS 9.8EG 9.8
2025-12-22
A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulation of the argument uname results in sql injection. The attack can be executed remotely. The exploit …
CVE-2025-15002CRITICALCVSS 9.8EG 9.8
2025-12-21
A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Such manipulation of the argument page/limit leads to sql injection. The attack ca…
CVE-2025-14990CRITICALCVSS 9.8EG 9.8
2025-12-21
A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-appointment.php. Performing a manipulation of the argument viewid results in sql …
CVE-2025-14989CRITICALCVSS 9.8EG 9.8
2025-12-21
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/search-invoices.php. Such manipulation leads to sql injection. The attack can be…
CVE-2025-14711CRITICALCVSS 9.8EG 9.8
2025-12-15
A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This manipulation of the argument pickedHotelName/type c…
CVE-2025-14710CRITICALCVSS 9.8EG 9.8
2025-12-15
A vulnerability was detected in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This affects an unknown part of the file /controller/api/OrderList.php. The manipulation of the argument telephone results in sql in…
CVE-2025-14707CRITICALCVSS 9.8EG 9.8
2025-12-15
A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command…
CVE-2025-14706CRITICALCVSS 9.8EG 9.8
2025-12-15
A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be …
CVE-2025-14705CRITICALCVSS 9.8EG 9.8
2025-12-15
A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. …
CVE-2025-14668CRITICALCVSS 9.8EG 9.8
2025-12-14
A vulnerability was detected in campcodes Advanced Online Examination System 1.0. This affects an unknown function of the file /query/loginExe.php. Performing a manipulation of the argument Username results in sql injection. It is possible…
CVE-2025-14667CRITICALCVSS 9.8EG 9.8
2025-12-14
A security vulnerability has been detected in itsourcecode COVID Tracking System 1.0. The impacted element is an unknown function of the file /admin/?page=system_info. Such manipulation of the argument meta_value leads to sql injection. Th…
CVE-2025-14666CRITICALCVSS 9.8EG 9.8
2025-12-14
A weakness has been identified in itsourcecode COVID Tracking System 1.0. The affected element is an unknown function of the file /admin/?page=user. This manipulation of the argument Username causes sql injection. The attack is possible to…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →