Weakness (CWE)
CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it (2 mitigations)
-
Requirements
Programming languages and supporting technologies might be chosen which are not subject to these issues.
-
Implementation
Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Source: MITRE CWE-74
2,710 results · Clear filters · Feed
-
High 7.3
zyx0814 FilePress Publish search.php sql injection
A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can…
-
High 7.3
SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in sql injection. It is possible t…
-
High 7.3
SourceCodester Online Faculty Clearance System delete_requirement.php sql injection
A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to…
-
High 7.3
SourceCodester/katojkalemba Online Food Ordering System order.php sql injection
A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The ex…
-
High 7.3
SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection
A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible t…
-
High 7.3
SourceCodester College Notes Gallery Management System login.php sql injection
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. …
-
High 7.3
PHPGurukul Daily Expense Tracker System forgot-password.php sql injection
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried…
-
High 7.3
PHPGurukul Daily Expense Tracker System Login index.php sql injection
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitat…
-
High 7.3
PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the arg…
-
High 7.3
HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is …
-
High 7.3
subhajitkhan online-clinic-management-system doctorlogin.php sql injection
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injectio…
-
High 7.3
itsourcecode Leave Management System login.php sql injection
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched …
-
High 7.3
Yot CMS Cookie global.php login sql injection
A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to i…
-
High 7.3
subhajitkhan online-clinic-management-system listdoctor.php sql injection
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulation of the argument searchtext results i…
-
High 7.3
SourceCodester School Registration and Fee System save_class.php sql injection
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of t…
-
High 7.3
SourceCodester School Registration and Fee System pay_report.php sql injection
A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_report.php. Performing a manipulation of the argument period results in sql injection. The attack can…
-
High 7.3
SourceCodester School Registration and Fee System delete_stud.php sql injection
A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/delete_stud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The …
-
High 7.3
SourceCodester School Registration and Fee System save_stud.php sql injection
A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the att…
-
High 7.3
Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads …
-
High 7.3
Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument p…
-
High 7.3
Rizwan17 inventory-management-system manage.php update_record sql injection
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file includes/manage.php. The manipulation of the argument update_category/cid/update_brand/up…
-
High 8.3
Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendere…
-
High 7.3
SourceCodester Class and Exam Timetabling System delete_subject.php sql injection
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the…
-
High 8.3
D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely.…
-
High 7.3
SourceCodester Online Voting System ajax.php save_category sql injection
A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save_category. This manipulation of the argument Category causes sql injection. The attack can be initiated remotel…
-
High 7.3
jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injection
A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Execut…
-
High 7.3
itsourcecode School Management System User_Login.php sql injection
A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now pub…
-
High 7.3
SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. The a…
-
High 7.3
SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be…
-
High 7.3
SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation …
-
High 7.3
SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injection
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. The attack may be launche…
-
High 7.3
SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiat…
-
High 7.3
SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can b…
-
High 7.3
Mstfakts College-Management-System Search university.php mysqli_query sql injection
A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book_name/book_author results in sql injection…
-
High 7.3
rabindralamsal inventory-management-system Login index.php sql injection
A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be execu…
-
High 7.3
SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_user_account.php. Such manipulation of the argument ID leads to sql injection. T…
-
High 7.3
SourceCodester Class and Exam Timetabling System delete_user.php sql injection
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit …
-
High 7.3
SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. T…
-
High 7.3
code-projects Task Management System In PHP Login index.php sql injection
A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The att…
-
High 7.3
code-projects Content Management System login.php sql injection
A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument user_name results in sql injection. The attack can be executed remotely. T…