CWEweakness
CWE-791 Incomplete Filtering of Special Elements
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product receives data from an upstream component, but it does not completely filter special elements before sending it to a downstream component.
Common consequences
• Integrity: Unexpected State
Related
Child of · CWE (1)
- CWE-790 Improper Filtering of Special Elements weakness
Referenced by CVE · weakness (45)
- CVE-2026-108570 A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. vulnerability
- CVE-2026-103540 A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. vulnerability
- CVE-2026-102771 A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. vulnerability
- CVE-2026-86206 A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. vulnerability
- CVE-2026-78140 A flaw has been found in Dromara UJCMS up to 10.1.3. vulnerability
- CVE-2026-75979 A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. vulnerability
- CVE-2026-19929 A vulnerability was identified in OpenBoxes up to 0.9.6. vulnerability
- CVE-2026-18632 A security flaw has been discovered in langgenius dify up to 1.14.2. vulnerability
- CVE-2026-11998 A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to… vulnerability
- CVE-2026-48208 An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject… vulnerability
- CVE-2026-9498 A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. vulnerability
- CVE-2026-47323 Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations… vulnerability
- CVE-2026-8740 A flaw has been found in Sanluan PublicCMS 5.202506.d. vulnerability
- CVE-2026-44232 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. vulnerability
- CVE-2026-7164 Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. vulnerability
- CVE-2026-6984 A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. vulnerability
- CVE-2026-5987 A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d. vulnerability
- CVE-2026-5559 A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. vulnerability
- CVE-2026-3714 A vulnerability has been found in OpenCart 4.0.2.3. vulnerability
- CVE-2026-3725 A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. vulnerability
- CVE-2026-29186 Backstage is an open framework for building developer portals. vulnerability
- CVE-2026-2969 A flaw has been found in datapizza-labs datapizza-ai 0.0.2. vulnerability
- CVE-2025-14731 A weakness has been identified in CTCMS Content Management System up to 2.1.2. vulnerability
- CVE-2025-59303 HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with… vulnerability
- CVE-2025-9094 A vulnerability was detected in ThingsBoard 4.1. vulnerability
- CVE-2025-6761 A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. vulnerability
- CVE-2025-6518 A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. vulnerability
- CVE-2025-2336 Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module… vulnerability
- CVE-2025-0324 The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. vulnerability
- CVE-2025-5325 A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. vulnerability