CWEweakness

CWE-790 Improper Filtering of Special Elements

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product receives data from an upstream component, but it does not filter or incorrectly filters special elements before sending it to a downstream component.

Common consequences

• Integrity: Unexpected State

Related

Child of · CWE (1)

  • CWE-138 Improper Neutralization of Special Elements weakness

Referenced by CVE · weakness (15)

  • CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a… vulnerability
  • CVE-2026-9658 Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. vulnerability
  • CVE-2026-2328 An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via… vulnerability
  • CVE-2025-27260 Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if… vulnerability
  • CVE-2025-15576 If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an… vulnerability
  • CVE-2025-0431 Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which… vulnerability
  • CVE-2024-47984 Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. vulnerability
  • CVE-2024-42416 The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a… vulnerability
  • CVE-2024-43442 Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules)… vulnerability
  • CVE-2024-43443 Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS… vulnerability
  • CVE-2024-6540 Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an… vulnerability
  • CVE-2024-31616 An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2,… vulnerability
  • CVE-2023-45239 A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker… vulnerability
  • CVE-2023-22578 Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections. vulnerability
  • CVE-2021-43802 Etherpad is a real-time collaborative editor. vulnerability

Referenced by CWE · child of (2)

  • CWE-182 Collapse of Data into Unsafe Value weakness
  • CWE-791 Incomplete Filtering of Special Elements weakness