Weaknesses of type CWE-707
256 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2022-3519LOWSourceCodester Sanitization Management System Quote Requests Tab cross site scriptingEPSS 0.4%CVE-2022-4401LOWpallidlight online-course-selection-system cross site scriptingEPSS 0.4%CVE-2022-4249LOWMovie Ticket Booking System POST Request cross site scriptingEPSS 0.4%CVE-2022-4353LOWLinZhaoguan pb-cms IpUtil.getIpAddr cross site scriptingEPSS 0.4%CVE-2022-4456LOWfalling-fruit cross site scriptingEPSS 0.4%CVE-2022-4561LOWSemanticDrilldown Extension GET Parameter SDBrowseDataPage.php printFilterLine cross site scriptingEPSS 0.4%CVE-2022-3497LOWSourceCodester Human Resource Management System Master List cross site scriptingEPSS 0.4%CVE-2022-3493LOWSourceCodester Human Resource Management System Add Employee cross site scriptingEPSS 0.4%CVE-2024-10840MEDIUMromadebrian WEB-Sekolah Backend akun_edit.php cross site scriptingEPSS 0.4%CVE-2026-3813MEDIUMopencc JFlow WF_CCForm.java Calculate injectionEPSS 0.4%CVE-2022-3581LOWSourceCodester Cashier Queuing System Cashiers Tab cross site scriptingEPSS 0.4%CVE-2022-3580LOWSourceCodester Cashier Queuing System User Creation cross site scriptingEPSS 0.4%CVE-2022-3672LOWSourceCodester Sanitization Management System SystemSettings.php cross site scriptingEPSS 0.4%CVE-2022-3673LOWSourceCodester Sanitization Management System Master.php cross site scriptingEPSS 0.4%CVE-2022-3716LOWSourceCodester Online Medicine Ordering System cross site scriptingEPSS 0.4%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.3%CVE-2021-4271LOWpanicsteve w2wiki Markdown index.php toHTML cross site scriptingEPSS 0.3%CVE-2021-4270LOWImprint CMS ViewHelpers.cs SearchForm cross site scriptingEPSS 0.3%CVE-2022-4233LOWSourceCodester Event Registration System cross site scriptingEPSS 0.3%CVE-2024-21864HIGHImproper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated usEPSS 0.3%