CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 45)
Page 45 of 55 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10989 | Medium | 6.3 | 2024-11-08 | A vulnerability classified as critical has been found in code-projects E-Health Care System 1.0. This affects an unknown part of the file /Admin/detail.php. Th… |
CVE-2024-10988 | High | 7.3 | 2024-11-08 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-10987 | Medium | 6.3 | 2024-11-08 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-10969 | High | 7.3 | 2024-11-07 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-10968 | High | 7.3 | 2024-11-07 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-10967 | High | 7.3 | 2024-11-07 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file /Doctor/de… |
CVE-2024-10947 | Medium | 4.7 | 2024-11-07 | A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System up t… |
CVE-2024-10946 | Medium | 4.7 | 2024-11-07 | A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System… |
CVE-2024-10928 | Low | 3.5 | 2024-11-06 | A vulnerability was found in MonoCMS up to 20240528. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-10927 | Low | 3.5 | 2024-11-06 | A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php… |
CVE-2024-50340 | High | 7.3 | 2024-11-06 | symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php direc… |
CVE-2024-10926 | Low | 3.5 | 2024-11-06 | A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /toggle_fol… |
CVE-2024-10919 | Medium | 6.3 | 2024-11-06 | A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov… |
CVE-2024-10915 | High | 8.1 | 2024-11-06 | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the funct… |
CVE-2024-10914 | High | 8.1 | 2024-11-06 | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability i… |
CVE-2024-10845 | High | 7.3 | 2024-11-05 | A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2024-10844 | High | 7.3 | 2024-11-05 | A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search… |
CVE-2024-10842 | Low | 2.4 | 2024-11-05 | A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of th… |
CVE-2024-10841 | Medium | 5.5 | 2024-11-05 | A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses… |
CVE-2024-10840 | Low | 2.4 | 2024-11-05 | A vulnerability classified as problematic has been found in romadebrian WEB-Sekolah 1.0. Affected is an unknown function of the file /Admin/akun_edit.php of th… |
CVE-2024-10810 | Medium | 6.3 | 2024-11-05 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app… |
CVE-2024-10809 | Medium | 6.3 | 2024-11-05 | A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/… |
CVE-2024-10808 | Medium | 6.3 | 2024-11-05 | A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/… |
CVE-2024-10807 | Low | 2.4 | 2024-11-05 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown processing of the fil… |
CVE-2024-10806 | Low | 2.4 | 2024-11-05 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-10805 | Medium | 6.3 | 2024-11-04 | A vulnerability was found in code-projects University Event Management System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2024-10791 | High | 7.3 | 2024-11-04 | A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of th… |
CVE-2024-10768 | Low | 3.5 | 2024-11-04 | A vulnerability classified as problematic was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /admin/assets… |
CVE-2024-10752 | High | 7.3 | 2024-11-04 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /productsadd… |
CVE-2024-10700 | Medium | 6.3 | 2024-11-02 | A vulnerability was found in code-projects University Event Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2024-10697 | Medium | 6.3 | 2024-11-02 | A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file… |
CVE-2024-10491 | Medium | 4.0 | 2024-10-29 | A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data… |
CVE-2024-8309 | Critical | 9.8 | 2024-10-29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability c… |
CVE-2024-7472 | Medium | 6.5 | 2024-10-29 | lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/sign… |
CVE-2024-49381 | High | 7.5 | 2024-10-25 | Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitra… |
CVE-2024-49380 | High | 7.5 | 2024-10-25 | Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary… |
CVE-2024-48927 | Medium | 4.6 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to… |
CVE-2024-10157 | High | 7.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/p… |
CVE-2024-10153 | Medium | 6.3 | 2024-10-19 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-48918 | | 2024-10-16 | RDS Light is a simplified version of the Reflective Dialogue System (RDS), a self-reflecting AI framework. Versions prior to 1.1.0 contain a vulnerability that… | |
CVE-2024-47764 | | 2024-10-04 | cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpect… | |
CVE-2024-9324 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-47180 | High | 8.8 | 2024-09-26 | Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields u… |
CVE-2024-46997 | Critical | 9.8 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully co… |
CVE-2024-46983 | Critical | 9.8 | 2024-09-19 | sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict dese… |
CVE-2024-25673 | Medium | 6.1 | 2024-09-19 | Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection. |
CVE-2024-46986 | Critical | 9.9 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method… |
CVE-2024-45612 | Medium | 5.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (fr… |
CVE-2024-6702 | Medium | 5.2 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. |
CVE-2024-42903 | Medium | 6.5 | 2024-09-03 | A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password… |
CVE-2024-45312 | Medium | 5.3 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vu… |
CVE-2024-8367 | Low | 3.5 | 2024-09-01 | A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as proble… |
CVE-2024-2881 | Medium | 6.7 | 2024-08-30 | Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacke… |
CVE-2024-1545 | Medium | 5.9 | 2024-08-29 | Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker c… |
CVE-2024-45302 | Medium | 6.1 | 2024-08-29 | RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The… |
CVE-2024-42914 | Critical | 9.1 | 2024-08-23 | A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the… |
CVE-2024-43782 | High | 7.7 | 2024-08-23 | This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translat… |
CVE-2024-42472 | Critical | 10.0 | 2024-08-15 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persis… |
CVE-2024-31882 | Medium | 5.3 | 2024-08-14 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations… |
CVE-2024-42489 | Critical | 10.0 | 2024-08-12 | Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit… |
CVE-2024-39227 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-6331 | High | 7.5 | 2024-08-04 | stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration… |
CVE-2024-41127 | High | 8.3 | 2024-08-02 | Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-com… |
CVE-2024-39320 | Medium | 6.1 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypass… |
CVE-2024-7221 | Medium | 6.3 | 2024-07-30 | A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. This affects an unknown part of the file /admin/manage_user.php. T… |
CVE-2024-7220 | Medium | 6.3 | 2024-07-30 | A vulnerability was found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2024-7219 | High | 7.3 | 2024-07-30 | A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-40324 | Medium | 5.4 | 2024-07-25 | A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP… |
CVE-2024-0231 | Low | 2.7 | 2024-07-24 | A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft… |
CVE-2024-40137 | Medium | 5.5 | 2024-07-24 | Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Mo… |
CVE-2024-26020 | Critical | 9.6 | 2024-07-22 | An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code… |
CVE-2024-6933 | Medium | 6.3 | 2024-07-21 | A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.ph… |
CVE-2024-41122 | High | 7.5 | 2024-07-19 | Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflo… |
CVE-2024-41121 | High | 8.8 | 2024-07-19 | Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflo… |
CVE-2024-39906 | High | 8.3 | 2024-07-19 | A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality re… |
CVE-2024-41111 | High | 7.2 | 2024-07-18 | Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Slive… |
CVE-2024-20429 | Medium | 6.5 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitr… |
CVE-2024-40637 | Medium | 4.2 | 2024-07-16 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user install… |
CVE-2024-38700 | Medium | 6.5 | 2024-07-12 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This… |
CVE-2024-36522 | Critical | 9.8 | 2024-07-12 | The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source w… |
CVE-2024-37442 | Low | 3.8 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays all… |
CVE-2024-37253 | Low | 2.7 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code… |
CVE-2024-35777 | Low | 3.5 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoof… |
CVE-2024-6470 | Low | 2.7 | 2024-07-03 | A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=m… |
CVE-2024-6469 | Low | 2.7 | 2024-07-03 | A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index… |
CVE-2024-38366 | Critical | 10.0 | 2024-07-01 | trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email addres… |
CVE-2024-36420 | High | 7.5 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endp… |
CVE-2024-39704 | Critical | 9.8 | 2024-06-28 | Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code on a client's mach… |
CVE-2024-39243 | Critical | 9.8 | 2024-06-26 | An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save. |
CVE-2024-37759 | Critical | 9.8 | 2024-06-24 | DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface. |
CVE-2024-35728 | Medium | 5.3 | 2024-06-10 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Themeisle PPOM for WooCommerce allows Code… |
CVE-2024-5184 | Medium | 6.5 | 2024-06-05 | The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take… |
CVE-2023-23738 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spo… |
CVE-2024-34448 | High | 8.8 | 2024-05-22 | Ghost before 5.82.0 allows CSV Injection during a member CSV export. |
CVE-2024-5193 | Medium | 5.3 | 2024-05-22 | A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipu… |
CVE-2024-34919 | Critical | 9.8 | 2024-05-17 | An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 allows attackers to e… |
CVE-2024-34697 | High | 7.6 | 2024-05-14 | FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Fr… |
CVE-2024-34062 | Medium | 4.8 | 2024-05-03 | tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through p… |
CVE-2024-32986 | Critical | 9.6 | 2024-05-03 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as… |
CVE-2023-46304 | High | 8.1 | 2024-04-30 | modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows the… |