CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 3)
Page 3 of 55 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86236 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro_transac.php?ac… |
CVE-2026-86235 | Medium | 6.3 | 2026-09-07 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/pos_transac.php?action=add. Th… |
CVE-2026-86234 | Medium | 6.3 | 2026-09-07 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/cust_transac.php?action=add. The m… |
CVE-2026-86233 | Medium | 6.3 | 2026-09-07 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pa… |
CVE-2026-86232 | Medium | 6.3 | 2026-09-06 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/su… |
CVE-2026-86225 | High | 7.3 | 2026-09-06 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file… |
CVE-2026-86224 | High | 7.3 | 2026-09-06 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_prod… |
CVE-2026-86223 | High | 7.3 | 2026-09-06 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea… |
CVE-2026-86222 | High | 7.3 | 2026-09-06 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_cou… |
CVE-2026-86221 | High | 7.3 | 2026-09-06 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_c… |
CVE-2026-86220 | High | 7.3 | 2026-09-06 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/moda… |
CVE-2026-86213 | High | 7.3 | 2026-09-06 | A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the compo… |
CVE-2026-86252 | Medium | 5.3 | 2026-09-06 | h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events… |
CVE-2026-86211 | High | 7.3 | 2026-09-06 | A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing… |
CVE-2026-86210 | High | 7.3 | 2026-09-06 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2026-86209 | High | 7.3 | 2026-09-06 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This mani… |
CVE-2026-86208 | High | 7.3 | 2026-09-06 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php… |
CVE-2026-80439 | Medium | 4.8 | 2026-09-06 | The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it s… |
CVE-2026-80437 | Medium | 4.8 | 2026-09-06 | The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them… |
CVE-2026-19859 | Medium | 6.5 | 2026-09-06 | The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users… |
CVE-2026-86180 | High | 7.3 | 2026-09-06 | A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /inde… |
CVE-2026-86172 | Medium | 6.3 | 2026-09-06 | A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation… |
CVE-2026-86171 | Medium | 6.3 | 2026-09-06 | A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulat… |
CVE-2026-86170 | Medium | 6.3 | 2026-09-06 | A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation… |
CVE-2026-86168 | High | 7.3 | 2026-09-06 | A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The man… |
CVE-2026-86164 | Medium | 6.3 | 2026-09-06 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The mani… |
CVE-2026-86163 | Medium | 6.3 | 2026-09-06 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulatio… |
CVE-2026-86162 | High | 7.3 | 2026-09-06 | A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a man… |
CVE-2026-86161 | High | 7.3 | 2026-09-06 | A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category… |
CVE-2026-86160 | High | 7.3 | 2026-09-06 | A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voti… |
CVE-2026-86159 | High | 7.3 | 2026-09-06 | A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of… |
CVE-2026-85643 | Medium | 4.7 | 2026-09-04 | A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulatio… |
CVE-2026-85516 | High | 7.3 | 2026-09-04 | A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performin… |
CVE-2026-85403 | High | 7.3 | 2026-09-04 | A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation… |
CVE-2026-85402 | High | 7.3 | 2026-09-04 | A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The mani… |
CVE-2026-85399 | High | 7.3 | 2026-09-04 | A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file… |
CVE-2026-85398 | High | 7.3 | 2026-09-04 | A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of… |
CVE-2026-85397 | High | 7.3 | 2026-09-04 | A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulati… |
CVE-2026-85383 | Medium | 6.3 | 2026-09-04 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a m… |
CVE-2026-85379 | High | 7.3 | 2026-09-04 | A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the functi… |
CVE-2026-85225 | High | 7.3 | 2026-09-03 | A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The mani… |
CVE-2026-85205 | Medium | 6.3 | 2026-09-03 | A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controlle… |
CVE-2026-85187 | High | 7.3 | 2026-09-03 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the fi… |
CVE-2026-85138 | High | 7.3 | 2026-09-03 | A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipul… |
CVE-2026-85137 | High | 7.3 | 2026-09-03 | A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Col… |
CVE-2026-81571 | Medium | 4.8 | 2026-09-02 | The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allow… |
CVE-2026-19698 | Low | 3.5 | 2026-09-02 | The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the… |
CVE-2026-10821 | Medium | 6.6 | 2026-09-02 | The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache config… |
CVE-2026-82958 | | 2026-09-02 | In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting place… | |
CVE-2026-84153 | Medium | 6.3 | 2026-09-01 | A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavev… |
CVE-2026-84111 | High | 7.3 | 2026-09-01 | A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argume… |
CVE-2026-84109 | Medium | 6.3 | 2026-09-01 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Exe… |
CVE-2026-84061 | Medium | 6.3 | 2026-09-01 | A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file opench… |
CVE-2026-84059 | High | 7.4 | 2026-09-01 | A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=Se… |
CVE-2026-78363 | Medium | 4.8 | 2026-09-01 | The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a messag… |
CVE-2026-83772 | Critical | 9.9 | 2026-09-01 | A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the fi… |
CVE-2026-83524 | Critical | 9.9 | 2026-08-31 | A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec… |
CVE-2026-82971 | Critical | 10.0 | 2026-08-31 | A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Scri… |
CVE-2026-82922 | High | 7.3 | 2026-08-31 | A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=up… |
CVE-2026-77353 | Medium | 4.6 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar… |
CVE-2026-82914 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipula… |
CVE-2026-82701 | High | 7.3 | 2026-08-31 | A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the… |
CVE-2026-82696 | Medium | 6.3 | 2026-08-31 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php… |
CVE-2026-82666 | Medium | 4.7 | 2026-08-31 | A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorControll… |
CVE-2026-82620 | Medium | 6.3 | 2026-08-31 | A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseD… |
CVE-2026-82615 | High | 7.3 | 2026-08-31 | A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordr… |
CVE-2026-82614 | High | 7.3 | 2026-08-31 | A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=prod… |
CVE-2026-82613 | High | 7.3 | 2026-08-31 | A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of… |
CVE-2026-82612 | High | 7.3 | 2026-08-31 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the fi… |
CVE-2026-82611 | High | 7.3 | 2026-08-31 | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication… |
CVE-2026-82610 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file… |
CVE-2026-82609 | Medium | 6.3 | 2026-08-31 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit.php. The manipulati… |
CVE-2026-82600 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing… |
CVE-2026-82598 | High | 7.3 | 2026-08-31 | A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulatio… |
CVE-2026-82597 | High | 7.4 | 2026-08-31 | A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation… |
CVE-2026-82595 | High | 7.4 | 2026-08-31 | A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component S… |
CVE-2026-82545 | Medium | 6.3 | 2026-08-30 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipu… |
CVE-2026-82541 | Medium | 6.3 | 2026-08-30 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pag… |
CVE-2026-82540 | Medium | 6.3 | 2026-08-30 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manip… |
CVE-2026-82485 | Medium | 6.3 | 2026-08-30 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… |
CVE-2026-82484 | Medium | 6.3 | 2026-08-30 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation o… |
CVE-2026-82424 | Medium | 6.3 | 2026-08-29 | A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_ed… |
CVE-2026-82422 | Medium | 6.3 | 2026-08-29 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipul… |
CVE-2026-82421 | Medium | 6.3 | 2026-08-29 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The… |
CVE-2026-16759 | Medium | 6.5 | 2026-08-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation i… |
CVE-2026-81835 | Medium | 5.5 | 2026-08-28 | A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.p… |
CVE-2026-81834 | Medium | 6.3 | 2026-08-27 | A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Ha… |
CVE-2026-81833 | Medium | 5.5 | 2026-08-27 | A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/hel… |
CVE-2026-81526 | Medium | 6.5 | 2026-08-27 | The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server… |
CVE-2026-81523 | Medium | 4.4 | 2026-08-27 | A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted with… |
CVE-2026-19092 | Critical | 9.8 | 2026-08-27 | The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticat… |
CVE-2026-81203 | High | 7.3 | 2026-08-26 | A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=lo… |
CVE-2026-65646 | Critical | 9.9 | 2026-08-26 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files… |
CVE-2026-12717 | | 2026-08-26 | An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Goog… | |
CVE-2026-79912 | High | 8.3 | 2026-08-25 | A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Pe… |
CVE-2026-79845 | High | 7.3 | 2026-08-25 | A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php… |
CVE-2026-79804 | High | 7.3 | 2026-08-25 | A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown funct… |
CVE-2026-79234 | Medium | 6.5 | 2026-08-25 | Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromi… |
CVE-2026-79087 | Medium | 4.3 | 2026-08-25 | Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions via a crafted HTML… |
CVE-2026-78864 | Medium | 6.3 | 2026-08-25 | A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journ… |