Skip to content
OpenAdvisories

Weakness (CWE)

CWE-75: Failure to Sanitize Special Elements into a Different Plane

Class Draft Mapping discouraged

The product does not adequately filter user-controlled input for special elements with control implications.

How to prevent it (2 mitigations)

  1. Requirements

    Programming languages and supporting technologies might be chosen which are not subject to these issues.

  2. Implementation

    Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

Source: MITRE CWE-75

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-31908 Public exploit

    Apache APISIX: forward auth plugin allows header injection

    Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to ver…

    Apache Software Foundation Apache APISIX
  • Critical 9.6
    CVE-2024-27708

    Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker …

  • Critical 9.8
    CVE-2025-50213

    Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were add…

    Apache Software Foundation Apache Airflow Providers Snowflake apache-airflow-providers-snowflake PyPI
  • Critical 9.8
    CVE-2024-39227

    GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800…

  • Critical 9.8
    CVE-2024-39243

    An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/ad…

  • Critical 9.8
    CVE-2024-35373

    Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.

  • Critical 9.8
    CVE-2023-40743

    Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

    ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted …

    Apache Software Foundation Apache Axis axis org.apache.axis:axis Debian Ubuntu Maven
  • Critical 9.8
    CVE-2023-27533

    A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an att…

    curl curl curl Debian Ubuntu Alpine
  • Critical 10.0
    CVE-2021-32798

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook

    The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can b…

    jupyter notebook notebook jupyter-notebook Debian Ubuntu PyPI