CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 2)
Page 2 of 55 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94015 | High | 7.3 | 2026-09-20 | A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user… |
CVE-2026-94004 | High | 7.3 | 2026-09-20 | A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument… |
CVE-2026-93997 | High | 7.3 | 2026-09-20 | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/edit_s… |
CVE-2026-93980 | High | 7.3 | 2026-09-20 | A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the c… |
CVE-2026-93979 | High | 7.3 | 2026-09-20 | A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing… |
CVE-2026-93978 | High | 7.3 | 2026-09-20 | A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php… |
CVE-2026-93974 | High | 7.3 | 2026-09-20 | A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/data… |
CVE-2026-93973 | High | 7.3 | 2026-09-20 | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admin… |
CVE-2026-93972 | High | 7.3 | 2026-09-20 | A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /re… |
CVE-2026-93967 | Medium | 5.5 | 2026-09-20 | A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the… |
CVE-2026-93966 | Medium | 4.7 | 2026-09-20 | A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backen… |
CVE-2026-93965 | Medium | 6.6 | 2026-09-20 | A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO… |
CVE-2026-93963 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/control… |
CVE-2026-93959 | High | 7.3 | 2026-09-20 | A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admi… |
CVE-2026-93742 | Critical | 9.9 | 2026-09-19 | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipula… |
CVE-2026-87909 | High | 7.5 | 2026-09-19 | The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insuffic… |
CVE-2026-93371 | High | 8.3 | 2026-09-18 | A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/int… |
CVE-2026-87701 | Critical | 9.6 | 2026-09-17 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate… |
CVE-2026-92926 | High | 7.3 | 2026-09-17 | A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preferen… |
CVE-2026-93295 | | 2026-09-17 | MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed d… | |
CVE-2026-92526 | Medium | 6.3 | 2026-09-16 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulati… |
CVE-2026-20130 | Critical | 10.0 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-92406 | High | 7.3 | 2026-09-16 | A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments… |
CVE-2026-92405 | High | 7.3 | 2026-09-16 | A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /inde… |
CVE-2026-90999 | Critical | 9.8 | 2026-09-16 | Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed b… |
CVE-2026-92366 | High | 7.3 | 2026-09-16 | A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. T… |
CVE-2026-92364 | Medium | 6.3 | 2026-09-16 | A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/empl… |
CVE-2026-92132 | Medium | 5.4 | 2026-09-16 | Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity… |
CVE-2026-19857 | Medium | 4.8 | 2026-09-16 | The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a s… |
CVE-2026-92221 | Medium | 4.7 | 2026-09-16 | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function… |
CVE-2026-92213 | Medium | 5.5 | 2026-09-16 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client… |
CVE-2026-55374 | Medium | 4.8 | 2026-09-15 | canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::g… |
CVE-2026-12355 | High | 8.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12351 | Critical | 9.8 | 2026-09-15 | IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote a… |
CVE-2026-11927 | Medium | 6.5 | 2026-09-15 | IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services. |
CVE-2026-91986 | Medium | 5.4 | 2026-09-15 | gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafte… |
CVE-2026-91848 | High | 7.3 | 2026-09-15 | A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=articl… |
CVE-2026-91004 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1… |
CVE-2026-90880 | High | 7.4 | 2026-09-15 | A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of t… |
CVE-2026-90879 | High | 7.3 | 2026-09-15 | A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Pu… |
CVE-2026-90877 | High | 7.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requi… |
CVE-2026-90876 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2026-90855 | High | 7.3 | 2026-09-15 | A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. Thi… |
CVE-2026-90854 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /we… |
CVE-2026-90849 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2026-90846 | High | 7.3 | 2026-09-15 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manip… |
CVE-2026-90844 | High | 7.3 | 2026-09-15 | A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the compone… |
CVE-2026-90841 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ap… |
CVE-2026-90809 | High | 7.3 | 2026-09-14 | A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/a… |
CVE-2026-90805 | High | 7.3 | 2026-09-14 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file… |
CVE-2026-47256 | Medium | 5.3 | 2026-09-14 | OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry d… |
CVE-2026-90796 | Medium | 6.3 | 2026-09-14 | A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipul… |
CVE-2026-90789 | High | 7.3 | 2026-09-14 | A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Execut… |
CVE-2026-90709 | Medium | 4.7 | 2026-09-14 | A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the comp… |
CVE-2026-90708 | High | 7.3 | 2026-09-14 | A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Hand… |
CVE-2026-90704 | Medium | 6.6 | 2026-09-14 | A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulati… |
CVE-2026-90701 | High | 7.3 | 2026-09-14 | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown… |
CVE-2026-90700 | Medium | 6.3 | 2026-09-14 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Su… |
CVE-2026-90600 | Medium | 6.3 | 2026-09-13 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulat… |
CVE-2026-90597 | Medium | 6.3 | 2026-09-13 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_e… |
CVE-2026-90581 | Medium | 6.3 | 2026-09-13 | A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpd… |
CVE-2026-90574 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emp_transac.php?action=… |
CVE-2026-90526 | High | 7.3 | 2026-09-13 | A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_c… |
CVE-2026-90525 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executin… |
CVE-2026-90516 | High | 7.3 | 2026-09-13 | A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_r… |
CVE-2026-90515 | High | 7.3 | 2026-09-13 | A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/… |
CVE-2026-90514 | High | 7.3 | 2026-09-13 | A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.ph… |
CVE-2026-90511 | Medium | 6.3 | 2026-09-13 | A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file sr… |
CVE-2026-90496 | Medium | 4.7 | 2026-09-13 | A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file ap… |
CVE-2026-90495 | High | 7.3 | 2026-09-13 | A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models… |
CVE-2026-90491 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component El… |
CVE-2026-90488 | Medium | 6.3 | 2026-09-13 | A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/co… |
CVE-2026-85116 | Medium | 6.5 | 2026-09-11 | The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, i… |
CVE-2026-88038 | Medium | 4.8 | 2026-09-10 | cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name… |
CVE-2026-87925 | High | 7.3 | 2026-09-10 | A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function st… |
CVE-2026-87921 | High | 7.3 | 2026-09-09 | A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record o… |
CVE-2026-85117 | Medium | 6.5 | 2026-09-09 | The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor… |
CVE-2026-80440 | Medium | 4.8 | 2026-09-09 | The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the… |
CVE-2026-19855 | Medium | 6.5 | 2026-09-09 | The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, a… |
CVE-2026-87572 | High | 8.3 | 2026-09-09 | Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitra… |
CVE-2026-86675 | Medium | 6.3 | 2026-09-08 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us_edit.php. Such manipulation o… |
CVE-2026-65669 | Critical | 9.6 | 2026-09-08 | Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate pri… |
CVE-2026-86667 | Medium | 4.7 | 2026-09-08 | A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This… |
CVE-2026-86518 | Medium | 6.3 | 2026-09-08 | A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the arg… |
CVE-2026-86517 | Medium | 6.3 | 2026-09-08 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Ex… |
CVE-2026-86310 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. S… |
CVE-2026-86309 | Medium | 6.3 | 2026-09-07 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. This manipulation o… |
CVE-2026-86298 | High | 7.3 | 2026-09-07 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. P… |
CVE-2026-86295 | High | 8.3 | 2026-09-07 | A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The mani… |
CVE-2026-86291 | Medium | 6.3 | 2026-09-07 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/us_edit1.php. Su… |
CVE-2026-86290 | High | 7.3 | 2026-09-07 | A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save_category… |
CVE-2026-86282 | High | 7.3 | 2026-09-07 | A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of t… |
CVE-2026-79698 | Critical | 9.9 | 2026-09-07 | A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-E… |
CVE-2026-79697 | Critical | 9.9 | 2026-09-07 | A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-E… |
CVE-2026-86270 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings_edit.php… |
CVE-2026-86269 | Medium | 6.3 | 2026-09-07 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipu… |
CVE-2026-86268 | High | 7.3 | 2026-09-07 | A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the… |
CVE-2026-86267 | Medium | 6.3 | 2026-09-07 | A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the… |
CVE-2026-86265 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us… |
CVE-2026-86245 | Medium | 6.3 | 2026-09-07 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_… |