Weaknesses of type CWE-707
256 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2020-36609LOWannyshow DuxCMS Article edit cross site scriptingEPSS 0.4%CVE-2024-10768MEDIUMPHPGurukul Online Shopping Portal two_tables.php cross site scriptingEPSS 0.4%CVE-2022-4638LOWcollective.contact.widget widgets.py title cross site scriptingEPSS 0.4%CVE-2026-76443CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.4%CVE-2022-4089MEDIUMrickxy Stock Management System processlogin.php cross site scriptingEPSS 0.4%CVE-2022-3453LOWSourceCodester Book Store Management System transcation.php cross site scriptingEPSS 0.4%CVE-2022-4581LOW1j01 mind-map app.coffee cross site scriptingEPSS 0.4%CVE-2021-4251LOWas include.cdn.php getFullURL cross site scriptingEPSS 0.4%CVE-2021-4256LOWctrlo lenio index.tt cross site scriptingEPSS 0.4%CVE-2021-4272LOWstudygolang topics.js cross site scriptingEPSS 0.4%CVE-2021-4257LOWctrlo lenio Task task.tt cross site scriptingEPSS 0.4%CVE-2021-4253LOWctrlo lenio Ticket Lenio.pm cross site scriptingEPSS 0.4%CVE-2021-4254LOWctrlo lenio Notice main.tt cross site scriptingEPSS 0.4%CVE-2021-4255LOWctrlo lenio contractor.tt cross site scriptingEPSS 0.4%CVE-2022-4631LOWWP-Ban ban-options.php cross site scriptingEPSS 0.4%CVE-2022-4593LOWretra-system cross site scriptingEPSS 0.4%CVE-2022-3997MEDIUMMonikaBrzica scm upis_u_bazu.php sql injectionEPSS 0.4%CVE-2022-4377LOWS-CMS Contact Information Page cross site scriptingEPSS 0.4%CVE-2022-4400LOWzbl1996 FS-Blog Title cross site scriptingEPSS 0.4%CVE-2022-3943LOWForU CMS cms_chip.php cross site scriptingEPSS 0.4%