VYPR

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

ClassIncompleteLikelihood: High

Description

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-101 · CAPEC-105 · CAPEC-108 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-14 · CAPEC-24 · CAPEC-250 · CAPEC-267 · CAPEC-273 · CAPEC-28 · CAPEC-3 · CAPEC-34 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-51 · CAPEC-52 · CAPEC-53 · CAPEC-6 · CAPEC-64 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-76 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-83 · CAPEC-84 · CAPEC-9

CVEs mapped to this weakness (5,475)

page 22 of 274
  • CVE-2017-17517HigDec 14, 2017
    Sylpheed
    Sylpheed
    risk 0.57cvss 8.8epss 0.01

    libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

  • CVE-2017-17516HigDec 14, 2017
    Reddit Terminal Viewer Project
    Reddit Terminal Viewer
    risk 0.57cvss 8.8epss 0.01

    scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

  • CVE-2017-17515HigDec 14, 2017
    Metview
    Metview
    risk 0.57cvss 8.8epss 0.02

    etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to…

  • CVE-2017-17514HigDec 14, 2017
    Nip2 Project
    Nip2
    risk 0.57cvss 8.8epss 0.02

    boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does…

  • CVE-2017-17513HigDec 14, 2017
    Tug
    Texlive
    risk 0.57cvss 8.8epss 0.01

    TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun,…

  • CVE-2017-17511HigDec 14, 2017
    Kildclient
    Kildclient
    risk 0.57cvss 8.8epss 0.02

    KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c.

  • CVE-2017-17523HigDec 11, 2017
    Lilypond
    Lilypond
    risk 0.57cvss 8.8epss 0.02

    lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.

  • CVE-2017-17512HigDec 11, 2017
    Sensible Utils Project
    Sensible Utils
    risk 0.57cvss 8.8epss 0.02

    sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file…

  • CVE-2015-5227HigOct 18, 2017
    WordPress
    Landing Pages
    risk 0.57cvss 8.8epss 0.03

    The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.

  • CVE-2017-9135HigMay 21, 2017
    Mimosa
    Backhaul Radios
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST…

  • CVE-2017-9133HigMay 21, 2017
    Mimosa
    Backhaul Radios
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. In the device's web interface, after logging in, there is a page that allows you to ping other hosts from the device and view the results. The user is allowed to specify which…

  • CVE-2017-6031HigMay 6, 2017
    Certec
    Atvise SCADA
    risk 0.57cvss 8.8epss 0.03

    A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.

  • CVE-2017-2140HigApr 28, 2017
    Tablacus
    Explorer
    risk 0.57cvss 8.8epss 0.01

    Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.

  • CVE-2017-5585HigFeb 22, 2017
    Opentext
    Documentum Content Server
    risk 0.57cvss 8.8epss 0.02

    OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection…

  • CVE-2016-10131CriJan 12, 2017
    Codeigniter
    Codeigniter
    risk 0.57cvss 9.8epss 0.03

    system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.

  • CVE-2016-5685HigNov 29, 2016
    Dell
    Idrac7
    risk 0.57cvss 8.8epss 0.02

    Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.

  • CVE-2025-7350HigSep 9, 2025
    risk 0.56cvss —epss 0.01

    A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication.

  • CVE-2021-29085HigJun 23, 2021
    Synology
    Diskstation Manager
    risk 0.56cvss 8.6epss 0.01

    Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified…

  • CVE-2020-15252HigOct 16, 2020
    Cryptpad
    Xwiki
    risk 0.56cvss 8.5epss 0.03

    In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code…

  • CVE-2020-15146CriAug 20, 2020
    Sylius
    Syliusresourcebundle
    risk 0.56cvss 9.6epss 0.02

    In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that…