CWE-707 Improper Neutralization
pillarThe product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
01
child weaknesses
More specific entries beneath this one.
02
vulnerabilities (319)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26633US | —OT critical | KEV | ||
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2024-43572US | —OT critical | KEV | ||
Microsoft Management Console Remote Code Execution Vulnerability | ||||
| CVE-2017-6884US | high8.8OT critical | KEV | ||
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically… | ||||
| CVE-2024-10914US | critical9.8 | Exploit | ||
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_us… | ||||
| CVE-2023-41892US | critical9.8 | Exploit | ||
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to upd… | ||||
| CVE-2024-10915US | critical9.8 | Exploit | ||
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of t… | ||||
| CVE-2024-8522US | high7.5 | Exploit | ||
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint… | ||||
| CVE-2024-12828US | high8.8 | Exploit | ||
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authenti… | ||||
| CVE-2024-1781US | critical9.8 | Exploit | ||
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.c… | ||||
| CVE-2022-4257US | critical9.8 | — | ||
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component… | ||||
| CVE-2024-7464US | critical9.8 | — | ||
A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The mani… | ||||
| CVE-2022-3801US | high8.8 | — | ||
A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order… | ||||
| CVE-2025-53771US | — | Exploit | ||
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2023-44693US | critical9.8 | — | ||
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. | ||||
| CVE-2015-9251US | medium6.1 | Exploit | ||
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses… | ||||
| CVE-2023-51385US | medium6.5 | Exploit | ||
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain si… | ||||
| CVE-2024-29201US | critical9.9 | — | ||
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to exe… | ||||
| CVE-2026-20330US | critical9.9 | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Softwar… | ||||
| CVE-2023-33377US | critical9.8 | — | ||
Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary O… | ||||
| CVE-2022-4375US | critical9.8 | — | ||
A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the… | ||||
03
attack patterns (16)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan