Weaknesses of type CWE-707
262 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2026-5561MEDIUMCampcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injectionEPSS 0.3%CVE-2025-13268MEDIUMDromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injectionEPSS 0.3%CVE-2025-9797MEDIUMmrvautin expressCart Edit Product edit injectionEPSS 0.3%CVE-2026-10222MEDIUMNousResearch hermes-agent config.py _sanitize_env_lines injectionEPSS 0.3%CVE-2026-4516MEDIUMFoundation Agents MetaGPT DataInterpreter write_analysis_code.py injectionEPSS 0.3%CVE-2026-10661MEDIUMahujasid blender-mcp server.py open injectionEPSS 0.2%CVE-2026-9420MEDIUMKLiK SocialMediaWebsite HTTP GET Request Parameter injectionEPSS 0.2%CVE-2026-3992MEDIUMCodeGenieApp serverless-express Users Endpoint dynamodb.ts injectionEPSS 0.2%CVE-2026-7045MEDIUMbaomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injectionEPSS 0.2%CVE-2026-4511MEDIUMvanna-ai vanna legacy exec injectionEPSS 0.2%CVE-2022-3967MEDIUMVesta Control Panel sed main.sh argument injectionEPSS 0.2%CVE-2026-6599MEDIUMlangflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injectionEPSS 0.2%CVE-2025-3804MEDIUMthautwarm vscode-diana Jinja2 Template Gen.py injectionEPSS 0.2%CVE-2025-3805MEDIUMsarrionandia tournatrack Jinja2 Template check_id.py injectionEPSS 0.2%CVE-2026-10210MEDIUMAstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injectionEPSS 0.2%CVE-2026-6994MEDIUMEnvoy Query Parameter header_mutation.cc params.add injectionEPSS 0.2%CVE-2026-10223MEDIUMNousResearch hermes-agent memory_tool.py _scan_memory_content injectionEPSS 0.2%CVE-2023-42773HIGHImproper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escEPSS 0.2%CVE-2023-46689HIGHImproper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalEPSS 0.2%CVE-2025-24921MEDIUMImproper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unautheEPSS 0.2%