Skip to content
OpenAdvisories

Weakness (CWE)

CWE-75: Failure to Sanitize Special Elements into a Different Plane

Class Draft Mapping discouraged

The product does not adequately filter user-controlled input for special elements with control implications.

How to prevent it (2 mitigations)

  1. Requirements

    Programming languages and supporting technologies might be chosen which are not subject to these issues.

  2. Implementation

    Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

Source: MITRE CWE-75

All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 8.8
    CVE-2024-58362

    SurrealDB before 1.5.5 Query Injection via RPC API

    SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query …

    surrealdb surrealdb surrealdb surrealdb-core crates.io
  • High 8.1
    CVE-2026-54771

    Langroid: handle_message() executes user-supplied tool JSON without sender verification

    Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered…

    langroid langroid langroid PyPI
  • High 8.9
    CVE-2026-29042

    Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

    Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HT…

    nuclio nuclio github.com/nuclio/nuclio Go
  • High 8.8
    CVE-2024-37779

    WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via …

  • High 7.5
    CVE-2024-24257

    An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain se…

  • High 8.8
    CVE-2024-31809

    TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the Fil…

  • High 7.2
    CVE-2024-29686

    Winter CMS Server-Side Template Injection (SSTI) vulnerability

    Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be e…

    wintercms/winter Packagist
  • High 7.5
    CVE-2024-0801 EPSS 42%

    Unauthenticated DoS in Arcserve Unified Data Protection

    A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.

    Arcserve Unified Data Protection
  • High 7.8
    CVE-2024-0044 Public exploit

    In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input vali…

    Google Android Android
  • High 8.4
    CVE-2024-23274

    An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS So…

    Apple macOS macOS
  • High 8.4
    CVE-2024-23268

    An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS So…

    Apple macOS macOS
  • High 7.2
    CVE-2024-27622

    A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.…

  • High 8.9
    CVE-2023-1758

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • High 8.8
    CVE-2023-23912

    A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.…

  • High 8.6
    CVE-2023-0302

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • High 8.1
    CVE-2022-48217

    The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of …

  • High 8.8
    CVE-2021-39174 Public exploit

    Configuration leak

    Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various pas…

    fiveai Cachet cachethq/cachet Packagist
  • High 7.4
    CVE-2021-32797

    JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

    JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. U…

    jupyterlab jupyterlab notebook jupyterlab PyPI