CWE-75 · Injection and Smuggling
Failure to Sanitize Special Elements into a Different Plane
33CVEs
SortMost likely exploited
33 CVEs with CWE-75 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-22911CheckRocket.Chat <=3.13 - NoSQL InjectionRocket.chat · Rocket.Chat server · 2021-05-27 | – | 95% | 2021-05-27 |
| CVE-2024-0801CheckArcserve Unified Data Protection - Unauthenticated DoS in ASNative.dllArcserve · Unified Data Protection · CVSS 7.5 · 2024-03-13 | 7.5 | 42% | 2024-03-13 |
| CVE-2021-39174Configuration leakfiveai · Cachet · CVSS 8.8 · 2021-08-27 | 8.8 | 5.0% | 2021-08-27 |
| CVE-2026-29042Nuclio Shell Runtime Command Injection Leading to Privilege Escalationnuclio · nuclio · CVSS 8.9 · 2026-03-06 | 8.9 | 2.6% | 2026-03-06 |
| CVE-2021-22910A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potential…Rocket.chat · Rocket.Chat server · 2021-08-09 | – | 2.3% | 2021-08-09 |
| CVE-2023-27533A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet o…Haxx · https://github.com/curl/curl · CVSS 9.8 · 2023-03-30 | 9.8 | 2.2% | 2023-03-30 |
| CVE-2022-24039A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails…Siemens · Desigo PXC4 · 2022-05-10 | – | 2.0% | 2022-05-10 |
| CVE-2024-27622A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate san…Cmsmadesimple · Cms Made Simple · CVSS 7.2 · 2024-03-05 | 7.2 | 2.0% | 2024-03-05 |
| CVE-2024-0044In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege wit…Google · Android · CVSS 7.8 · 2024-03-11 | 7.8 | 1.5% | 2024-03-11 |
| CVE-2016-9471Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially,…Revive-Adserver · Revive Adserver All versions before 3.2.5 and 4.0.0 · 2017-03-28 | – | 1.4% | 2017-03-28 |
| CVE-2024-39227GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1…Gl-Inet · Mt6000 Firmware · CVSS 9.8 · 2024-08-06 | 9.8 | 1.2% | 2024-08-06 |
| CVE-2024-35373Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.Mocodo · Mocodo Online · CVSS 9.8 · 2024-05-24 | 9.8 | 1.2% | 2024-05-24 |
| CVE-2024-31809TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.Totolink · Ex200 Firmware · CVSS 8.8 · 2024-04-08 | 8.8 | 1.0% | 2024-04-08 |
| CVE-2023-23912A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dh…Ui · Ubiquiti EdgeRouter(s) and USG(s) · CVSS 8.8 · 2023-02-09 | 8.8 | 1.0% | 2023-02-09 |
| CVE-2022-48217The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a ro…Tradr-Project · Tf Remapper · CVSS 8.1 · 2023-01-04 | 8.1 | 0.8% | 2023-01-04 |
| CVE-2025-50213Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorApache Software Foundation · Apache Airflow Providers Snowflake · CVSS 9.8 · 2025-06-24 | 9.8 | 0.8% | 2025-06-24 |
| CVE-2024-58362SurrealDB before 1.5.5 Query Injection via RPC APIsurrealdb · surrealdb · CVSS 8.8 · 2026-07-18 | 8.8 | 0.6% | 2026-07-18 |
| CVE-2024-27708Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.Airc · Mynet · CVSS 9.6 · 2025-12-22 | 9.6 | 0.6% | 2025-12-22 |
| CVE-2023-1758Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq · CVSS 8.9 · 2023-04-05 | 8.9 | 0.5% | 2023-04-05 |
| CVE-2026-31908Apache APISIX: forward auth plugin allows header injectionApache Software Foundation · Apache APISIX · CVSS 9.1 · 2026-04-14 | 9.1 | 0.5% | 2026-04-14 |
| CVE-2022-4721Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 6.6 · 2022-12-23 | 6.6 | 0.5% | 2022-12-23 |
| CVE-2024-39243An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save.Skycaiji · Skycaiji · CVSS 9.8 · 2024-06-26 | 9.8 | 0.5% | 2024-06-26 |
| CVE-2022-3607Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprintoctoprint · octoprint/octoprint · CVSS 6 · 2022-10-19 | 6.0 | 0.4% | 2022-10-19 |
| CVE-2024-23274An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to eleva…Apple · macOS · CVSS 8.4 · 2024-03-08 | 8.4 | 0.4% | 2024-03-08 |
| CVE-2024-23268An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to eleva…Apple · macOS · CVSS 8.4 · 2024-03-08 | 8.4 | 0.4% | 2024-03-08 |
| CVE-2024-9940Calculated Fields Form <= 5.2.45 - HTML Injectioncodepeople · Calculated Fields Form · CVSS 5.3 · 2024-10-17 | 5.3 | 0.4% | 2024-10-17 |
| CVE-2026-54771Langroid: handle_message() executes user-supplied tool JSON without sender verificationlangroid · langroid · CVSS 8.1 · 2026-07-09 | 8.1 | 0.4% | 2026-07-09 |
| CVE-2024-31806TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the system without authorizat…Totolink · Ex200 Firmware · CVSS 6.5 · 2024-04-08 | 6.5 | 0.4% | 2024-04-08 |
| CVE-2024-24257An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script to the csl/user com…No vendor recorded · CVSS 7.5 · 2024-07-26 | 7.5 | 0.4% | 2024-07-26 |
| CVE-2023-0302Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2radareorg · radareorg/radare2 · CVSS 8.6 · 2023-01-15 | 8.6 | 0.4% | 2023-01-15 |
| CVE-2024-31812In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.Totolink · Ex200 Firmware · CVSS 6.5 · 2024-04-08 | 6.5 | 0.3% | 2024-04-08 |
| CVE-2025-61911python-ldap has sanitization bypass in ldap.filter.escape_filter_charspython-ldap · python-ldap · CVSS 5.5 · 2025-10-10 | 5.5 | 0.3% | 2025-10-10 |
| CVE-2026-27120Leaf-kit html escaping does not work on characters that are part of extended grapheme clustervapor · leaf-kit · CVSS 6.1 · 2026-02-20 | 6.1 | 0.3% | 2026-02-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.