Skip to content
OpenAdvisories

Weakness (CWE)

CWE-74: Injection

Class Incomplete Mapping discouraged Improper Neutralization of Special Elements in Output Used by a Downstream Component

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How to prevent it (2 mitigations)

  1. Requirements

    Programming languages and supporting technologies might be chosen which are not subject to these issues.

  2. Implementation

    Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE-74

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-20281 Exploited Public exploit EPSS 98%

    Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

    A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerab…

    Cisco Cisco Identity Services Engine Software Network devices
    KEV Jul 28, 2025
  • Critical 10.0
    CVE-2023-22527 Exploited · Ransomware Public exploit EPSS 100%

    A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated att…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Jan 24, 2024
  • High 8.8
    CVE-2022-43769 Exploited Public exploit EPSS 98%

    Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

    Hitachi Vantara Pentaho Business Analytics Server
    KEV Mar 3, 2025
  • Critical 9.8
    CVE-2022-46169 Exploited Public exploit EPSS 100%

    Unauthenticated Command Injection

    Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

    Cacti cacti cacti cacti Debian Ubuntu
    KEV Feb 16, 2023
  • Critical 9.8
    CVE-2022-35914 Exploited Public exploit EPSS 100%

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    KEV Mar 7, 2023
  • Critical 9.8
    CVE-2022-22965 Exploited Public exploit EPSS 100%

    Remote Code Execution in Spring Framework

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

    libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
    KEV Apr 4, 2022
  • Critical 9.8
    CVE-2020-17496 Exploited Public exploit EPSS 87%

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2019-17558 Exploited Public exploit EPSS 99%

    Improper Input Validation in Apache Solr

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configse…

    org.apache.solr:solr-core lucene-solr Debian Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-11581 Exploited Public exploit EPSS 85%

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

    Atlassian Jira Server and Data Center Web / CMS
    KEV Mar 7, 2022
  • Critical 9.8
    CVE-2013-2251 Exploited Public exploit EPSS 100%

    Code injection in Apache Struts

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

    org.apache.struts:struts2-core Maven
    KEV Mar 25, 2022