Skip to content
Noroxi

CWE-75 · 29 records

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

CVEs in this class

29 records

  • CVE-2021-22911
    68This week

    A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injectio

    CriticalCVSS 9.8Proof of conceptEPSS 95%

    rocket.chat · rocket.chatMay 27, 2021

  • CVE-2024-0801
    43Plan

    Unauthenticated DoS in Arcserve Unified Data Protection

    HighCVSS 7.5Proof of conceptEPSS 41%

    arcserve · udpMar 13, 2024

  • CVE-2021-22910
    40Plan

    A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could

    CriticalCVSS 9.8No exploitEPSS 2%

    rocket.chat · rocket.chatAug 9, 2021

  • CVE-2024-35373
    39Monitor

    Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    mocodo · mocodo onlineMay 24, 2024

  • CVE-2025-50213
    39Monitor

    Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

    CriticalCVSS 9.8No exploitEPSS 0%

    apache · apache-airflow-providers-snowflakeJun 24, 2025

  • CVE-2021-39174
    37Monitor

    Cachet is an open source status page system.

    HighCVSS 8.8Proof of conceptEPSS 5%

    catchethq · catchetAug 27, 2021

  • CVE-2022-24039
    37Monitor

    A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884).

    CriticalCVSS 9.0No exploitEPSS 2%

    siemens · desigo pxc5 firmwareMay 10, 2022

  • CVE-2026-29042
    36Monitor

    Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

    HighCVSS 8.9No exploitEPSS 3%

    iguazio · nuclioMar 6, 2026

  • CVE-2023-27533
    36Monitor

    A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on mali

    HighCVSS 8.8No exploitEPSS 2%

    haxx · curlMar 30, 2023

  • CVE-2026-31908
    36Monitor

    Apache APISIX: forward auth plugin allows header injection

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    apache · apisixApr 14, 2026

  • CVE-2024-37779
    35Monitor

    WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script

    HighCVSS 8.8No exploitEPSS 1%

    Sep 23, 2024

  • CVE-2024-31809
    35Monitor

    TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in th

    HighCVSS 8.8No exploitEPSS 0%

    totolink · ex200 firmwareApr 8, 2024

  • CVE-2023-23912
    35Monitor

    A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with t

    HighCVSS 8.8No exploitEPSS 0%

    ui · usg firmwareFeb 9, 2023

  • CVE-2024-58362
    34Monitor

    SurrealDB before 1.5.5 Query Injection via RPC API

    HighCVSS 8.7No exploitEPSS 0%

    surrealdb · surrealdbJul 18, 2026

  • CVE-2022-48217
    32Monitor

    The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in t

    HighCVSS 8.1No exploitEPSS 0%

    tradr-project · tf remapperJan 4, 2023

  • CVE-2026-54771
    32Monitor

    Langroid: handle_message() executes user-supplied tool JSON without sender verification

    HighCVSS 8.1No exploitEPSS 0%

    langroid · langroidJul 9, 2026

  • CVE-2023-0302
    31Monitor

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2

    HighCVSS 7.8No exploitEPSS 0%

    radare · radare2Jan 14, 2023

  • CVE-2024-24257
    30Monitor

    An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information v

    HighCVSS 7.5No exploitEPSS 0%

    Jul 26, 2024

  • CVE-2024-27622
    29Monitor

    A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21.

    HighCVSS 7.2No exploitEPSS 1%

    cmsmadesimple · cms made simpleMar 5, 2024

  • CVE-2024-31806
    26Monitor

    TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which c

    MediumCVSS 6.5No exploitEPSS 0%

    totolink · ex200 firmwareApr 8, 2024

  • CVE-2024-31812
    26Monitor

    In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExt

    MediumCVSS 6.5No exploitEPSS 0%

    totolink · ex200 firmwareApr 8, 2024

  • CVE-2022-3607
    24Monitor

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint

    MediumCVSS 6.0No exploitEPSS 0%

    octoprint · octoprintOct 19, 2022

  • CVE-2026-27120
    24Monitor

    Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

    MediumCVSS 6.1No exploitEPSS 0%

    vapor · leafkitFeb 20, 2026

  • CVE-2025-61911
    22Monitor

    python-ldap has sanitization bypass in ldap.filter.escape_filter_chars

    MediumCVSS 5.5No exploitEPSS 0%

    python-ldap · python-ldapOct 10, 2025

  • CVE-2023-1758
    21Monitor

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

    MediumCVSS 5.4No exploitEPSS 0%

    phpmyfaq · phpmyfaqApr 5, 2023

All vulnerability classes