Weaknesses of type CWE-707
256 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2022-3495HIGHSourceCodester Simple Online Public Access Catalog Admin Login sql injectionEPSS 0.7%CVE-2022-3942MEDIUMSourceCodester Sanitization Management System cross site scriptingEPSS 0.7%CVE-2022-4222MEDIUMSourceCodester Canteen Management System POST Request ajax_invoice.php query sql injectionEPSS 0.7%CVE-2021-27493MEDIUMPhilips Vue PACS EPSS 0.7%CVE-2022-4277MEDIUMShaoxing Background Management System Bd sql injectionEPSS 0.7%CVE-2022-3504MEDIUMSourceCodester Sanitization Management System sql injectionEPSS 0.7%CVE-2022-4520LOWWSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scriptingEPSS 0.7%CVE-2022-4274MEDIUMHouse Rental System view-property.php sql injectionEPSS 0.6%CVE-2022-4275MEDIUMHouse Rental System POST Request search-property.php sql injectionEPSS 0.6%CVE-2021-4262MEDIUMlaravel-jqgrid EloquentRepositoryAbstract.php getRows sql injectionEPSS 0.6%CVE-2022-3877LOWClick Studios Passwordstate URL Field cross site scriptingEPSS 0.6%CVE-2022-3988LOWFrappe Search navbar_search.html cross site scriptingEPSS 0.6%CVE-2022-3783LOWnode-red-dashboard ui_text Format ui-component-ctrl.js cross site scriptingEPSS 0.6%CVE-2022-3332MEDIUMSourceCodester Food Ordering Management System POST Parameter router.php sql injectionEPSS 0.6%CVE-2022-3804MEDIUMeolinker apinto-dashboard login cross site scriptingEPSS 0.6%CVE-2024-10752MEDIUMCodezips Pet Shop Management System productsadd.php sql injectionEPSS 0.6%CVE-2024-9324MEDIUMIntelbras InControl Relatório de Operadores Page operador code injectionEPSS 0.6%CVE-2022-3972HIGHPingkon HMS-PHP adminlogin.php sql injectionEPSS 0.6%CVE-2022-3799MEDIUMIBAX go-ibax tablesInfo sql injectionEPSS 0.6%CVE-2022-3973HIGHPingkon HMS-PHP Data Pump Metadata admin.php sql injectionEPSS 0.6%