CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,216 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 80 of 105

CVE-2025-9418CRITICALCVSS 9.8EG 9.8
2025-08-25
A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /owner/addowner.php. Such manipulation of the argument ID leads to sql injection. It is possible to lau…
CVE-2025-9419CRITICALCVSS 9.8EG 9.8
2025-08-25
A vulnerability was detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /unit/addunit.php. Performing manipulation of the argument ID results in sql injection. The attack can be…
CVE-2025-9420CRITICALCVSS 9.8EG 9.8
2025-08-25
A flaw has been found in itsourcecode Apartment Management System 1.0. The impacted element is an unknown function of the file /floor/addfloor.php. Executing manipulation of the argument hdnid can lead to sql injection. The attack can be l…
CVE-2025-9421CRITICALCVSS 9.8EG 9.8
2025-08-25
A vulnerability has been found in itsourcecode Apartment Management System 1.0. This affects an unknown function of the file /complain/addcomplain.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated…
CVE-2025-9423CRITICALCVSS 9.8EG 9.8
2025-08-25
A vulnerability was determined in Campcodes Online Water Billing System 1.0. Affected is an unknown function of the file /editecex.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possibl…
CVE-2025-9425CRITICALCVSS 9.8EG 9.8
2025-08-25
A security flaw has been discovered in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /enquiry.php. Performing manipulation of the argument pid results in sql inj…
CVE-2025-9426CRITICALCVSS 9.8EG 9.8
2025-08-25
A weakness has been identified in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing manipulation of the argument subcatid can lead to sql injection. The attack may b…
CVE-2025-9444CRITICALCVSS 9.8EG 9.8
2025-08-26
A vulnerability has been found in 1000projects Online Project Report Submission and Evaluation System 1.0. This issue affects some unknown processing of the file /admin/controller/delete_group_student.php. The manipulation of the argument …
CVE-2025-9468CRITICALCVSS 9.8EG 9.8
2025-08-26
A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /bill/add_bill.php. Such manipulation of the argument ID leads to sql inject…
CVE-2025-9469CRITICALCVSS 9.8EG 9.8
2025-08-26
A vulnerability was detected in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fund/add_fund.php. Performing manipulation of the argument ID results in sql injection. The att…
CVE-2025-9470CRITICALCVSS 9.8EG 9.8
2025-08-26
A flaw has been found in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /management/add_m_committee.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launche…
CVE-2025-9471CRITICALCVSS 9.8EG 9.8
2025-08-26
A vulnerability has been found in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /maintenance/add_maintenance_cost.php. The manipulation of the argument ID leads to sql injection. Remote e…
CVE-2025-9472CRITICALCVSS 9.8EG 9.8
2025-08-26
A vulnerability was found in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /owner_utility/add_owner_utility.php. The manipulation of the argument ID results in sql injection. The attac…
CVE-2025-9473CRITICALCVSS 9.8EG 9.8
2025-08-26
A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. This impacts an unknown function of the file /feedback.php. The manipulation of the argument msg leads to sql injection. The attack can be init…
CVE-2025-9492CRITICALCVSS 9.8EG 9.8
2025-08-26
A vulnerability was determined in Campcodes Online Water Billing System 1.0. This affects an unknown function of the file /addclient1.php. Executing manipulation of the argument lname can lead to sql injection. The attack can be launched r…
CVE-2025-9502CRITICALCVSS 9.8EG 9.8
2025-08-27
A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=save_payment. Executing manipulation of the argument loan_id can lead to sql injection. The attack…
CVE-2025-9503CRITICALCVSS 9.8EG 9.8
2025-08-27
A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Affected is an unknown function of the file /ajax.php?action=save_borrower. The manipulation of the argument lastname leads to sql injection. Remote…
CVE-2025-9504CRITICALCVSS 9.8EG 9.8
2025-08-27
A vulnerability was detected in Campcodes Online Loan Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_plan. The manipulation of the argument ID results in sql injection. T…
CVE-2025-9505CRITICALCVSS 9.8EG 9.8
2025-08-27
A flaw has been found in Campcodes Online Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_loan_type. This manipulation of the argument ID causes sql injection. The attack i…
CVE-2025-9506CRITICALCVSS 9.8EG 9.8
2025-08-27
A vulnerability has been found in Campcodes Online Loan Management System 1.0. This affects an unknown part of the file /ajax.php?action=delete_plan. Such manipulation of the argument ID leads to sql injection. The attack may be performed …
CVE-2025-9507CRITICALCVSS 9.8EG 9.8
2025-08-27
A weakness has been identified in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/visitor_info.php. Executing manipulation of the argument vid can lead to sql injection. The attack can be l…
CVE-2025-9508CRITICALCVSS 9.8EG 9.8
2025-08-27
A vulnerability was detected in itsourcecode Apartment Management System 1.0. The impacted element is an unknown function of the file /report/rented_info.php. The manipulation of the argument rsid results in sql injection. The attack may b…
CVE-2025-9509CRITICALCVSS 9.8EG 9.8
2025-08-27
A security flaw has been discovered in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/fair_info_all.php. Performing manipulation of the argument fid results in sql injection. Th…
CVE-2025-9510CRITICALCVSS 9.8EG 9.8
2025-08-27
A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /branch/addbranch.php. The manipulation of the argument ID leads to sql injection. The atta…
CVE-2025-9511CRITICALCVSS 9.8EG 9.8
2025-08-27
A vulnerability was identified in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /visitor/addvisitor.php. Such manipulation of the argument ID leads to sql injection. It is possible to lau…
CVE-2025-9531HIGHCVSS 8.8EG 8.8
2025-08-27
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection. …
CVE-2025-9532HIGHCVSS 8.8EG 8.8
2025-08-27
A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. …
CVE-2025-9581CRITICALCVSS 9.8EG 9.8
2025-08-28
A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phy_interface results in command injection. The attack may be initiated remote…
CVE-2025-9582CRITICALCVSS 9.8EG 9.8
2025-08-28
A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploi…
CVE-2025-9583HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulation leads to command injection. Remote exploitation of the attack is possible. The…
CVE-2025-9584HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of the argument interface/display_name results in command injection. The attack ca…
CVE-2025-9585HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possibl…
CVE-2025-9586HIGHCVSS 8.8EG 8.8
2025-08-28
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be perform…
CVE-2025-9592CRITICALCVSS 9.8EG 9.8
2025-08-28
A vulnerability was detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/bill_info.php. Performing manipulation of the argument vid results in sql injection. Remote exploi…
CVE-2025-9593CRITICALCVSS 9.8EG 9.8
2025-08-28
A flaw has been found in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/unit_status_info.php. Executing manipulation of the argument usid can lead to sql injection. The attack can be execu…
CVE-2025-9594CRITICALCVSS 9.8EG 9.8
2025-08-28
A vulnerability has been found in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /report/complain_info.php. The manipulation of the argument vid leads to sql injection. The attack is p…
CVE-2025-9596CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /login.php. This manipulation of the argument User causes sql injection. It is possible to initiate the attack remote…
CVE-2025-9597CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was identified in itsourcecode Apartment Management System 1.0. This impacts an unknown function of the file /o_dashboard/rented_all_info.php. Such manipulation of the argument uid leads to sql injection. It is possible to …
CVE-2025-9598CRITICALCVSS 9.8EG 9.8
2025-08-29
A security flaw has been discovered in itsourcecode Apartment Management System 1.0. Affected is an unknown function of the file /setting/year_setup.php. Performing manipulation of the argument txtXYear results in sql injection. The attack…
CVE-2025-9599CRITICALCVSS 9.8EG 9.8
2025-08-29
A weakness has been identified in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/month_setup.php. Executing manipulation of the argument txtMonthName can lead t…
CVE-2025-9600CRITICALCVSS 9.8EG 9.8
2025-08-29
A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /setting/member_type_setup.php. The manipulation of the argument txtMemberType lea…
CVE-2025-9601CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was detected in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /setting/employee_salary_setup.php. The manipulation of the argument ddlEmpName results in sql injection. The attack may…
CVE-2025-9603CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. Th…
CVE-2025-9606HIGHCVSS 8.8EG 8.8
2025-08-29
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing manipulation of the argument cod_agenda results in sql inj…
CVE-2025-9607HIGHCVSS 8.8EG 8.8
2025-08-29
A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argu…
CVE-2025-9608HIGHCVSS 8.8EG 8.8
2025-08-29
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql inje…
CVE-2025-9610CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. The attack is possib…
CVE-2025-9643CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was found in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/utility_bill_setup.php. Performing manipulation of the argument txtGasBill results i…
CVE-2025-9644CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was determined in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /setting/bill_setup.php. Executing manipulation of the argument txtBillType can lead to sql in…
CVE-2025-9645CRITICALCVSS 9.8EG 9.8
2025-08-29
A vulnerability was identified in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /t_dashboard/r_all_info.php. The manipulation of the argument mid leads to sql injection. The attack can be initiated …

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →