Home/CWE/Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Weakness

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-74 · Class · Incomplete

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-707 · Improper Neutralization
Children (more specific)
ParentOfCWE-1236 · Improper Neutralization of Formula Elements in a CSV File
ParentOfCWE-75 · Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
ParentOfCWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
ParentOfCWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
ParentOfCWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
ParentOfCWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
ParentOfCWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
ParentOfCWE-91 · XML Injection (aka Blind XPath Injection)
ParentOfCWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
ParentOfCWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
ParentOfCWE-94 · Improper Control of Generation of Code ('Code Injection')
ParentOfCWE-943 · Improper Neutralization of Special Elements in Data Query Logic
ParentOfCWE-99 · Improper Control of Resource Identifiers ('Resource Injection')
◆

Attack Patterns (CAPEC)

30
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-10Buffer Overflow via Environment Variables
CAPEC-101Server Side Include (SSI) Injection
CAPEC-105HTTP Request Splitting
CAPEC-108Command Line Execution through SQL Injection
CAPEC-120Double Encoding
CAPEC-13Subverting Environment Variable Values
CAPEC-135Format String Injection
CAPEC-14Client-side Injection-induced Buffer Overflow
CAPEC-24Filter Failure through Buffer Overflow
CAPEC-250XML Injection
CAPEC-267Leverage Alternate Encoding
CAPEC-273HTTP Response Smuggling
CAPEC-28Fuzzing
CAPEC-3Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-34HTTP Response Splitting
CAPEC-42MIME Conversion
CAPEC-43Exploiting Multiple Input Interpretation Layers
CAPEC-45Buffer Overflow via Symbolic Links
CAPEC-46Overflow Variables and Tags
CAPEC-47Buffer Overflow via Parameter Expansion
CAPEC-51Poison Web Service Registry
CAPEC-52Embedding NULL Bytes
CAPEC-53Postfix, Null Terminate, and Backslash
CAPEC-6Argument Injection
CAPEC-64Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-67String Format Overflow in syslog()
CAPEC-7Blind SQL Injection
CAPEC-71Using Unicode Encoding to Bypass Validation Logic
CAPEC-72URL Encoding
CAPEC-76Manipulating Web Input to File System Calls
⚠

CVEs With This Weakness

4,713
A sample of the 4,713 CVEs tagged with this weakness.
CVECVE-2026-8785
CVECVE-2026-8777
CVECVE-2026-8774
CVECVE-2026-8773
CVECVE-2026-8772
CVECVE-2026-8771
CVECVE-2026-8753
CVECVE-2026-8734
CVECVE-2026-8724
CVECVE-2026-8346
CVECVE-2026-8345
CVECVE-2026-8344
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalCode-Projects School Fees Payment System 1.0 - SQL Injection
criticalCacti <=1.2.22 - Remote Command Injection
criticalGLPI <=10.0.2 - Remote Command Execution
criticalPrestaShop - SQL Injection to Eval Injection
criticalRoxy-WI - Remote Code Execution
criticalRoxy-WI < 6.1.1.0 - Remote Code Execution
criticalBudibase - Authentication Bypass
criticalCraft CMS < 3.3.0 - Server-Side Template Injection
criticalNette Framework - Remote Code Execution
criticalApache Unomi <1.5.2 - Remote Code Execution
criticalvBulletin 5.5.4 - 5.6.2- Remote Command Execution
criticalSCIMono <0.0.19 - Remote Code Execution
criticalThinfinity Iframe Injection
criticalSercomm VD625 Smart Modems - CRLF Injection
criticalAtlassian Confluence - Remote Code Execution
criticalEmbedded JavaScript(EJS) 3.1.6 - Template Injection
criticalWAVLINK WN579X3 - Remote Command Execution
criticalCamaleon CMS < 2.8.1 Arbitrary File Write to RCE
criticalIBM Operational Decision Manager - JNDI Injection
criticalOracle WebLogic Server - Remote Command Execution
criticalAtlassian Jira Server-Side Template Injection
criticalFUEL CMS 1.4.1 - Remote Code Execution
highJinher OA - SQL Injection
highHitachi Pentaho Business Analytics Server - Remote Code Execution
highProxmox - CRLF Injection
highOctober CMS - Remote Code Execution
highosTicket - Arbitrary File Read
highD-Link DIR-610 Devices - Information Disclosure
highLDAP Injection In OpenAM
highpfSense - Arbitrary File Write
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin