CWE-153: Improper Neutralization of Substitution Characters
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.
5 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-53006 — Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
- CVE-2025-53005 — Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability
- CVE-2025-53004 — Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
- CVE-2025-49003 — Dataease H2 JDBC Connection Remote Code Execution
- CVE-2026-9694 — Improper Neutralization of Substitution Characters in GitLab
Recently published
- CVE-2026-9694 — Improper Neutralization of Substitution Characters in GitLab
- CVE-2025-53006 — Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
- CVE-2025-53005 — Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability
- CVE-2025-53004 — Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
- CVE-2025-49003 — Dataease H2 JDBC Connection Remote Code Execution