CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-10 · CAPEC-101 · CAPEC-105 · CAPEC-108 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-14 · CAPEC-24 · CAPEC-250 · CAPEC-267 · CAPEC-273 · CAPEC-28 · CAPEC-3 · CAPEC-34 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-51 · CAPEC-52 · CAPEC-53 · CAPEC-6 · CAPEC-64 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-76 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-83 · CAPEC-84 · CAPEC-9
CVEs mapped to this weakness (5,155)
page 239 of 258| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-22035 | Med | 0.28 | 4.3 | 0.01 | Oct 13, 2021 | VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV… | ||
| CVE-2021-21580 | Med | 0.28 | 4.3 | 0.01 | Aug 3, 2021 | Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message… | ||
| CVE-2020-36308 | Med | 0.28 | 5.3 | 0.01 | Apr 6, 2021 | Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries. | ||
| CVE-2020-28031 | Med | 0.28 | 4.3 | 0.01 | Nov 2, 2020 | eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users. | ||
| CVE-2020-15011 | Med | 0.28 | 4.3 | 0.02 | Jun 24, 2020 | GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. | ||
| CVE-2016-11068 | Med | 0.28 | 5.3 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. | ||
| CVE-2020-9495 | Med | 0.28 | 5.3 | 0.08 | Jun 19, 2020 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to… | ||
| CVE-2020-3246 | Med | 0.28 | 4.3 | 0.01 | May 6, 2020 | A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An… | ||
| CVE-2019-15616 | Med | 0.28 | 4.3 | 0.01 | Feb 4, 2020 | Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. | ||
| CVE-2019-11282 | Med | 0.28 | 4.3 | 0.01 | Oct 23, 2019 | Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA. | ||
| CVE-2019-11275 | Med | 0.28 | 4.3 | 0.01 | Oct 1, 2019 | Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can… | ||
| CVE-2019-5977 | Med | 0.28 | 4.3 | 0.01 | Sep 12, 2019 | Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'. | ||
| CVE-2018-20898 | Med | 0.28 | 4.3 | 0.01 | Aug 1, 2019 | cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396). | ||
| CVE-2019-1680 | Med | 0.28 | 4.3 | 0.01 | Feb 7, 2019 | A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerability by convincing a targeted user to… | ||
| CVE-2017-5246 | Med | 0.28 | 4.3 | 0.01 | Jul 18, 2017 | Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}). This expression will be evaluated by any other… | ||
| CVE-2016-8720 | Med | 0.28 | 4.3 | 0.01 | Apr 13, 2017 | An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location… | ||
| CVE-2016-5013 | Med | 0.28 | 5.4 | 0.01 | Jan 20, 2017 | In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. | ||
| CVE-2015-8748 | Med | 0.28 | 5.3 | 0.02 | Feb 3, 2016 | Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*". | ||
| CVE-2026-11487 | Med | 0.27 | 5.3 | 0.01 | Jun 8, 2026 | A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on… | ||
| CVE-2026-7580 | Med | 0.27 | 5.3 | 0.00 | May 1, 2026 | A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading… |
- risk 0.28cvss 4.3epss 0.01
VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV…
- risk 0.28cvss 4.3epss 0.01
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message…
- risk 0.28cvss 5.3epss 0.01
Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.
- risk 0.28cvss 4.3epss 0.01
eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.
- risk 0.28cvss 4.3epss 0.02
GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.
- risk 0.28cvss 5.3epss 0.01
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
- risk 0.28cvss 5.3epss 0.08
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to…
- risk 0.28cvss 4.3epss 0.01
A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An…
- risk 0.28cvss 4.3epss 0.01
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
- risk 0.28cvss 4.3epss 0.01
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.
- risk 0.28cvss 4.3epss 0.01
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can…
- risk 0.28cvss 4.3epss 0.01
Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'.
- risk 0.28cvss 4.3epss 0.01
cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).
- risk 0.28cvss 4.3epss 0.01
A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerability by convincing a targeted user to…
- risk 0.28cvss 4.3epss 0.01
Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}). This expression will be evaluated by any other…
- risk 0.28cvss 4.3epss 0.01
An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location…
- risk 0.28cvss 5.4epss 0.01
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
- risk 0.28cvss 5.3epss 0.02
Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
- risk 0.27cvss 5.3epss 0.01
A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on…
- risk 0.27cvss 5.3epss 0.00
A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading…