Weaknesses of type CWE-707
262 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2022-4353LOWLinZhaoguan pb-cms IpUtil.getIpAddr cross site scriptingEPSS 0.4%CVE-2021-4271LOWpanicsteve w2wiki Markdown index.php toHTML cross site scriptingEPSS 0.4%CVE-2026-97182MEDIUMhalo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralizationEPSS 0.4%CVE-2021-4270LOWImprint CMS ViewHelpers.cs SearchForm cross site scriptingEPSS 0.4%CVE-2022-4233LOWSourceCodester Event Registration System cross site scriptingEPSS 0.4%CVE-2026-76993LOWGreyDGL PentestGPT Web-Page Crawling injectionEPSS 0.4%CVE-2026-76526HIGHImproper Neutralization in Splunk SOAREPSS 0.4%CVE-2024-21864HIGHImproper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated usEPSS 0.3%CVE-2026-76453HIGHCisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization VulnerabilitiesEPSS 0.3%CVE-2025-14674MEDIUMaizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injectionEPSS 0.3%CVE-2026-11457MEDIUMerzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injectionEPSS 0.3%CVE-2026-92213MEDIUMa2ui-project a2ui Angular Renderer server-to-client.ts z.any injectionEPSS 0.3%CVE-2026-5002MEDIUMPromtEngineer localGPT LLM Prompt server.py _route_using_overviews injectionEPSS 0.3%CVE-2026-76499CRITICALCisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization VulnerabilitiesEPSS 0.3%CVE-2026-9353MEDIUMNousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injectionEPSS 0.3%CVE-2026-9366MEDIUMNousResearch hermes-agent prompt_builder.py _scan_context_content injectionEPSS 0.3%CVE-2026-10221MEDIUMNousResearch hermes-agent run_agent.py _compress_context injectionEPSS 0.3%CVE-2026-10220MEDIUMNousResearch hermes-agent skills_tool.py skill_view injectionEPSS 0.3%CVE-2026-9422MEDIUMKLiK SocialMediaWebsite HTTP POST Request Parameter injectionEPSS 0.3%CVE-2025-66545LOWNextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash binEPSS 0.3%