CWEweakness

CWE-75 Failure to Sanitize Special Elements into a Different Plane

Official page ↗
Alternate terms
Special Element Injection
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not adequately filter user-controlled input for special elements with control implications.

Common consequences

• Integrity, Confidentiality, Availability: Modify Application Data, Execute Unauthorized Code or Commands

Potential mitigations

• [Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues. • [Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

Related

Attack pattern · CAPEC (2)

  • CAPEC-81 Web Server Logs Tampering attack pattern
  • CAPEC-93 Log Injection-Tampering-Forging attack pattern

Child of · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-81 Web Server Logs Tampering attack pattern
  • CAPEC-93 Log Injection-Tampering-Forging attack pattern

Referenced by CVE · weakness (36)

  • CVE-2024-58362 SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API… vulnerability
  • CVE-2026-54771 Langroid is a framework for building large-language-model-powered applications. vulnerability
  • CVE-2026-31908 Header injection vulnerability in Apache APISIX. vulnerability
  • CVE-2026-29042 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. vulnerability
  • CVE-2026-27120 Leafkit is a templating language with Swift-inspired syntax. vulnerability
  • CVE-2024-27708 Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary… vulnerability
  • CVE-2025-61911 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. vulnerability
  • CVE-2025-50213 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. vulnerability
  • CVE-2024-9940 The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. vulnerability
  • CVE-2024-37779 WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant… vulnerability
  • CVE-2024-39227 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B… vulnerability
  • CVE-2024-24257 An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information… vulnerability
  • CVE-2024-39243 An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to… vulnerability
  • CVE-2024-35373 Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. vulnerability
  • CVE-2024-31806 TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which… vulnerability
  • CVE-2024-31809 TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in… vulnerability
  • CVE-2024-31812 In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function… vulnerability
  • CVE-2024-21503 Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the… vulnerability
  • CVE-2024-0801 A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll. vulnerability
  • CVE-2024-0044 In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. vulnerability
  • CVE-2024-23268 An injection issue was addressed with improved input validation. vulnerability
  • CVE-2024-23274 An injection issue was addressed with improved input validation. vulnerability
  • CVE-2024-27622 A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. vulnerability
  • CVE-2023-40743 ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service… vulnerability
  • CVE-2023-1758 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to… vulnerability
  • CVE-2023-27533 A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on… vulnerability
  • CVE-2023-23912 A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with… vulnerability
  • CVE-2023-0302 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to… vulnerability
  • CVE-2022-48217 The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in… vulnerability
  • CVE-2022-4721 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to… vulnerability
Show all 36 ›

Referenced by CWE · child of (1)

  • CWE-76 Improper Neutralization of Equivalent Special Elements weakness

Referenced by OWASP · mapped cwe (1)