CWE-74— Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.— MITRE CWE catalog

5,216 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-74page 96 of 105

CVE-2026-44182CRITICALCVSS 10.0EG 10.0
2026-06-03
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KER…
CVE-2026-44246HIGHCVSS 7.2EG 7.2
2026-05-12
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The work…
CVE-2026-44455MEDIUMCVSS 4.7EG 4.7
2026-05-13
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML ou…
CVE-2026-44458MEDIUMCVSS 4.3EG 4.3
2026-05-13
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property na…
CVE-2026-4466MEDIUMCVSS 4.7EG 4.7
2026-03-20
A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation leads to command injection. Remote exploitation of the attack i…
CVE-2026-4467MEDIUMCVSS 4.7EG 4.7
2026-03-20
A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=wireless_device_dissoc. The manipulation results in command injection. The attack can be executed r…
CVE-2026-4468MEDIUMCVSS 4.7EG 4.7
2026-03-20
A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET&section=update_interface_png. This manipulation causes command injection. The attack is possible to be …
CVE-2026-4469MEDIUMCVSS 9.8EG 4.7
2026-03-20
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_edit_menu_action.php. Such manipulation of the argument product_nam…
CVE-2026-4470MEDIUMCVSS 9.8EG 4.7
2026-03-20
A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_nam…
CVE-2026-4471MEDIUMCVSS 9.8EG 4.7
2026-03-20
A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_employee.php. Executing a manipulation of the argument First_Name can lead to sql injection.…
CVE-2026-4472MEDIUMCVSS 9.8EG 6.3
2026-03-20
A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /admin/admin_edit_supplier.php. The manipulation of the argument Supplier_Name leads to…
CVE-2026-4473MEDIUMCVSS 9.8EG 4.7
2026-03-20
A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_action.php. The manipulation of the argument appointment_id results in sql injecti…
CVE-2026-4485MEDIUMCVSS 6.3EG 6.3
2026-03-20
A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php. The manipulation of the argument Search leads to sql injection. The attack is …
CVE-2026-4500MEDIUMCVSS 6.3EG 6.3
2026-03-20
A vulnerability was identified in bagofwords1 bagofwords up to 0.0.297. This impacts the function generate_df of the file backend/app/ai/code_execution/code_execution.py. Such manipulation leads to injection. The attack may be launched rem…
CVE-2026-4504HIGHCVSS 7.3EG 7.3
2026-03-20
A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack re…
CVE-2026-4506MEDIUMCVSS 6.3EG 6.3
2026-03-20
A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core/mindsql_core.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploi…
CVE-2026-4507MEDIUMCVSS 6.3EG 6.3
2026-03-20
A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the file mindsql/core/mindsql_core.py. Executing a manipulation can lead to sql injection. The attack can be launched remot…
CVE-2026-4508HIGHCVSS 7.3EG 7.3
2026-03-20
A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username lead…
CVE-2026-4511MEDIUMCVSS 6.3EG 6.3
2026-03-21
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclose…
CVE-2026-4513MEDIUMCVSS 6.3EG 6.3
2026-03-21
A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function ask of the file vanna\legacy\base\base.py. Performing a manipulation results in sql injection. The attack is possible to be carried …
CVE-2026-4515MEDIUMCVSS 6.3EG 6.3
2026-03-21
A vulnerability has been found in Foundation Agents MetaGPT up to 0.8.1. This affects the function code_generate of the file metagpt/ext/aflow/scripts/operator.py. The manipulation leads to code injection. It is possible to initiate the at…
CVE-2026-4516MEDIUMCVSS 6.3EG 6.3
2026-03-21
A vulnerability was found in Foundation Agents MetaGPT up to 0.8.1. This vulnerability affects unknown code of the file metagpt/actions/di/write_analysis_code.py of the component DataInterpreter. The manipulation results in injection. It i…
CVE-2026-4530MEDIUMCVSS 5.3EG 5.3
2026-03-22
A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminology_retriever.py. Performing a manipulation of the argument Description results in sql injection. The…
CVE-2026-4533MEDIUMCVSS 8.8EG 6.3
2026-03-22
A vulnerability was detected in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file all-tickets.php. The manipulation of the argument Status results in sql injection. It is possib…
CVE-2026-45344HIGHCVSS 8.1EG 8.1
2026-05-28
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env witho…
CVE-2026-4537MEDIUMCVSS 4.7EG 4.7
2026-03-22
A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack…
CVE-2026-4540HIGHCVSS 7.3EG 7.3
2026-03-22
A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql inje…
CVE-2026-4543MEDIUMCVSS 6.3EG 6.3
2026-03-22
A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag result…
CVE-2026-4550MEDIUMCVSS 4.7EG 4.7
2026-03-22
A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainer_id/fname leads to sql injection. The attack can be ex…
CVE-2026-4554MEDIUMCVSS 8.8EG 6.3
2026-03-22
A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch th…
CVE-2026-4564MEDIUMCVSS 4.7EG 4.7
2026-03-23
A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monitor/job/ of the component Quartz Job Handler. Such manipulation of the argument invokeTarget leads t…
CVE-2026-4568MEDIUMCVSS 6.5EG 6.3
2026-03-23
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component HTTP GET Request Handler. The manipulation of the argument sid results in sql in…
CVE-2026-4569MEDIUMCVSS 6.5EG 6.3
2026-03-23
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /view_category.php of the component HTTP POST Request Handler. This manipulation of the argument searchtxt causes…
CVE-2026-4570MEDIUMCVSS 8.8EG 6.3
2026-03-23
A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the component HTTP POST Request Handler. Such manipulation of the argument searchtxt leads …
CVE-2026-4571MEDIUMCVSS 6.5EG 6.3
2026-03-23
A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_payments.php of the component HTTP POST Request Handler. Performing a manipu…
CVE-2026-4572MEDIUMCVSS 6.5EG 6.3
2026-03-23
A weakness has been identified in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /view_product.php of the component HTTP POST Request Handler. Executing a manipulation of the…
CVE-2026-4573MEDIUMCVSS 6.3EG 6.3
2026-03-23
A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/form_handlers/delete_post.php of the component HTTP GET Parameter Handler. The manipulation of th…
CVE-2026-4574MEDIUMCVSS 6.3EG 6.3
2026-03-23
A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is p…
CVE-2026-4579HIGHCVSS 9.8EG 7.3
2026-03-23
A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parameters Handler. The manipulation of the argument serviceId leads to sql injection.…
CVE-2026-4580HIGHCVSS 9.8EG 7.3
2026-03-23
A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkupdatestatus.php of the component Parameters Handler. The manipulation of the argument serviceId results in …
CVE-2026-4581HIGHCVSS 9.8EG 7.3
2026-03-23
A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Parameters Handler. This manipulation of the argument Username causes sql injection. Th…
CVE-2026-4597MEDIUMCVSS 6.3EG 6.3
2026-03-23
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of the component Stream Prox…
CVE-2026-4612HIGHCVSS 7.3EG 7.3
2026-03-23
A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument…
CVE-2026-4613HIGHCVSS 7.3EG 7.3
2026-03-24
A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The …
CVE-2026-4614MEDIUMCVSS 6.3EG 6.3
2026-03-24
A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php of the component Parameter Handler. This manipulation of the argument subject_co…
CVE-2026-4615HIGHCVSS 7.3EG 7.3
2026-03-24
A vulnerability was identified in SourceCodester Online Catering Reservation 1.0. Impacted is an unknown function of the file /search.php. Such manipulation of the argument rcode leads to sql injection. The attack may be performed from rem…
CVE-2026-4624HIGHCVSS 7.3EG 7.3
2026-03-24
A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the component Parameter Handler. Performing a manipulation of the argument searchFiel…
CVE-2026-4625HIGHCVSS 7.3EG 7.3
2026-03-24
A flaw has been found in SourceCodester Online Admission System 1.0. This affects an unknown function of the file /programmes.php. Executing a manipulation of the argument program can lead to sql injection. The attack can be launched remot…
CVE-2026-4632HIGHCVSS 7.3EG 7.3
2026-03-24
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name…
CVE-2026-46546MEDIUMCVSS 5.4EG 5.4
2026-06-10
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surface…

Map vulnerabilities like CWE-74 to your infrastructure

EchelonGraph correlates every CVE — across CWE-74 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →