Weaknesses of type CWE-707
251 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 97.4%CVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 79.1%CVE-2024-43572HIGHMicrosoft Management Console Remote Code Execution VulnerabilityEPSS 66.6%KEVCVE-2022-4257MEDIUMC-DATA Web Management System GET Parameter jumpto.php argument injectionEPSS 43.9%CVE-2025-26633HIGHMicrosoft Management Console Security Feature Bypass VulnerabilityEPSS 30.4%KEVCVE-2022-3801MEDIUMIBAX go-ibax rowsInfo sql injectionEPSS 30.1%CVE-2020-11080LOWDenial of service in nghttp2EPSS 5.3%CVE-2021-4242MEDIUMSapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injectionEPSS 3.0%CVE-2022-4375MEDIUMMingsoft MCMS list sql injectionEPSS 2.9%CVE-2022-3800MEDIUMIBAX go-ibax rowsInfo sql injectionEPSS 2.2%CVE-2020-11026HIGHSpecially crafted filenames in WordPress leading to XSSEPSS 2.1%CVE-2020-11030MEDIUMCross-site scripting (XSS) in Search block in WordPressEPSS 1.4%CVE-2022-4064MEDIUMDalli Meta Protocol request_formatter.rb self.meta_set injectionEPSS 1.3%CVE-2022-4011MEDIUMSimple History Plugin Header neutralization for logsEPSS 1.0%CVE-2022-3492MEDIUMSourceCodester Human Resource Management System Profile Photo os command injectionEPSS 1.0%CVE-2024-10844MEDIUM1000 Projects Bookstore Management System search.php sql injectionEPSS 0.9%CVE-2024-10845MEDIUM1000 Projects Bookstore Management System book_detail.php sql injectionEPSS 0.9%CVE-2022-4727LOWOpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scriptingEPSS 0.9%CVE-2022-4566MEDIUMy_project RuoYi GenController sql injectionEPSS 0.8%CVE-2022-4322MEDIUMmaku-boot Scheduled Task AbstractScheduleJob.java doExecute injectionEPSS 0.8%