CWE-76 Improper Neutralization of Equivalent Special Elements
baseThe product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (19)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-0493US | high8.8 | Exploit | ||
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
| ||||
| CVE-2024-1883US | medium6.1 | — | ||
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a s… | ||||
| CVE-2026-91184US | high8.8 | — | ||
Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and u… | ||||
| CVE-2026-77180US | high8.3 | — | ||
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-co… | ||||
| CVE-2026-66362US | high8.1 | — | ||
Description:
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gat… | ||||
| CVE-2024-1882US | high7.2 | — | ||
This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/… | ||||
| CVE-2026-11311US | medium6.5 | — | ||
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.… | ||||
| CVE-2024-21600US | medium6.5 | — | ||
An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated,… | ||||
| CVE-2023-1149US | medium5.4 | — | ||
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. | ||||
| CVE-2024-1221US | low3.1 | — | ||
This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry… | ||||
| CVE-2024-34359US | — | — | ||
llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `… | ||||
| CVE-2026-54722US | — | — | ||
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter w… | ||||
| CVE-2026-55723US | — | — | ||
When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGIN… | ||||
| CVE-2026-50107US | — | — | ||
When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of N… | ||||
| CVE-2026-28292US | — | — | ||
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes… | ||||
| CVE-2024-9774US | — | — | ||
A vulnerability was found in python-sql where unary operators do not escape non-Expression. | ||||
| CVE-2024-4897US | — | — | ||
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311… | ||||
| CVE-2024-2952US | — | — | ||
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan