Weaknesses of type CWE-707

262 results

Neutralização Inadequada de Entrada

A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.

Example

Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).

How to mitigate

Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.

CVE-2026-4500MEDIUMbagofwords1 bagofwords code_execution.py generate_df injectionEPSS 0.4%CVE-2022-3968LOWemlog article_save.php cross site scriptingEPSS 0.4%CVE-2022-4350LOWMingsoft MCMS search.do cross site scriptingEPSS 0.4%CVE-2022-4348LOWy_project RuoYi-Cloud JSON cross site scriptingEPSS 0.4%CVE-2022-4631LOWWP-Ban ban-options.php cross site scriptingEPSS 0.4%CVE-2021-4254LOWctrlo lenio Notice main.tt cross site scriptingEPSS 0.4%CVE-2021-4272LOWstudygolang topics.js cross site scriptingEPSS 0.4%CVE-2021-4257LOWctrlo lenio Task task.tt cross site scriptingEPSS 0.4%CVE-2022-4638LOWcollective.contact.widget widgets.py title cross site scriptingEPSS 0.4%CVE-2021-4255LOWctrlo lenio contractor.tt cross site scriptingEPSS 0.4%CVE-2021-4256LOWctrlo lenio index.tt cross site scriptingEPSS 0.4%CVE-2021-4251LOWas include.cdn.php getFullURL cross site scriptingEPSS 0.4%CVE-2022-4581LOW1j01 mind-map app.coffee cross site scriptingEPSS 0.4%CVE-2022-4593LOWretra-system cross site scriptingEPSS 0.4%CVE-2021-4253LOWctrlo lenio Ticket Lenio.pm cross site scriptingEPSS 0.4%CVE-2022-4347LOWxiandafu beetl-bbs WebUtils.java cross site scriptingEPSS 0.4%CVE-2022-4089MEDIUMrickxy Stock Management System processlogin.php cross site scriptingEPSS 0.4%CVE-2022-3580LOWSourceCodester Cashier Queuing System User Creation cross site scriptingEPSS 0.4%CVE-2022-3581LOWSourceCodester Cashier Queuing System Cashiers Tab cross site scriptingEPSS 0.4%CVE-2022-3519LOWSourceCodester Sanitization Management System Quote Requests Tab cross site scriptingEPSS 0.4%