CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Description
The product does not adequately filter user-controlled input for special elements with control implications.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-75 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-xw2c-hrr9-4xwr | CVE-2024-58362 | HIGH | - |
Duplicate Advisory: Untrusted Query Object Evaluation in RPC API |
2026-09-04 |
| GHSA-4hfh-fch3-5q7p | CVE-2026-27120 | MODERATE | - |
Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster |
2026-04-22 |
| GHSA-95fj-3w7g-4r27 | CVE-2026-29042 | HIGH |
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation |
2026-03-06 | |
| GHSA-r7r6-cc7p-4v5m | CVE-2025-61911 | MODERATE |
python-ldap has sanitization bypass in ldap.filter.escape_filter_chars |
2025-10-13 | |
| GHSA-9r64-3wmc-x8m8 | CVE-2025-50213 | CRITICAL |
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator |
2025-06-27 | |
| GHSA-rmqp-9w4c-gc7w | CVE-2023-40743 | CRITICAL |
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService |
2025-02-13 | |
| GHSA-4952-p58q-6crx | CVE-2021-32797 | MODERATE |
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> |
2024-11-18 | |
| GHSA-83pm-7v48-5jp4 | CVE-2022-4721 | MODERATE |
rdiffweb vulnerable to Special Element Injection |
2024-10-25 | |
| GHSA-rj5f-vm79-5j84 | CVE-2022-3607 | MODERATE |
OctoPrint vulnerable to Special Element Injection |
2024-10-08 | |
| GHSA-hwvq-6gjx-j797 | CVE-2021-32798 | HIGH |
Special Element Injection in notebook |
2024-10-01 | |
| GHSA-64f8-pjgr-9wmr | - | HIGH | - |
Untrusted Query Object Evaluation in RPC API |
2024-09-11 |
| GHSA-8r5j-gm3j-cx9c | CVE-2024-29686 | HIGH | - |
Winter CMS Server-Side Template Injection (SSTI) vulnerability |
2024-08-02 |
| GHSA-fj7x-q9j7-g6q6 | CVE-2024-21503 | MODERATE |
Black vulnerable to Regular Expression Denial of Service (ReDoS) |
2024-03-20 | |
| GHSA-cvg2-7c3j-g36j | CVE-2023-6134 | MODERATE |
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri |
2023-12-18 | |
| GHSA-5968-qw33-h47j | - | MODERATE |
Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri |
2023-12-18 | |
| GHSA-3j93-7rf7-p7m6 | CVE-2023-1758 | HIGH | - |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter |
2023-04-06 |
| GHSA-88f9-7xxh-c688 | CVE-2021-39174 | HIGH | - |
Cachet configuration leak |
2022-08-16 |
| GHSA-rp2c-jrgp-cvr8 | CVE-2021-23562 | MODERATE |
Code injection in plupload |
2021-12-06 |