Weaknesses of type CWE-707
256 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2024-10791MEDIUMCodezips Hospital Appointment System doctorAction.php sql injectionEPSS 0.6%CVE-2021-4261MEDIUMpacman-canvas db-handler.php addHighscore sql injectionEPSS 0.6%CVE-2022-3473MEDIUMSourceCodester Human Resource Management System getstatecity.php sql injectionEPSS 0.6%CVE-2022-3464MEDIUMpuppyCMS settings.php cross site scriptingEPSS 0.6%CVE-2022-4051MEDIUMHostel Searching Project view-property.php sql injectionEPSS 0.6%CVE-2022-4396LOWRDFlib pyrdfa3 __init__.py _get_option cross site scriptingEPSS 0.6%CVE-2022-4403MEDIUMSourceCodester Canteen Management System ajax_represent.php sql injectionEPSS 0.6%CVE-2022-3803LOWeolinker apinto-dashboard cross site scriptingEPSS 0.6%CVE-2022-3546LOWSourceCodester Simple Cold Storage Management System Create User cross site scriptingEPSS 0.6%CVE-2022-3414MEDIUMSourceCodester Web-Based Student Clearance System POST Parameter login.php sql injectionEPSS 0.6%CVE-2022-4597LOWShoplazza LifeStyle Create Product v2_products cross site scriptingEPSS 0.6%CVE-2022-4596LOWShoplazza Add Blog Post cross site scriptingEPSS 0.6%CVE-2022-4088HIGHrickxy Stock Management System processlogin.php sql injectionEPSS 0.6%CVE-2022-3825MEDIUMHuaxia ERP User Management sql injectionEPSS 0.6%CVE-2022-3518LOWSourceCodester Sanitization Management System User Creation cross site scriptingEPSS 0.6%CVE-2022-3845LOWphpipam Import Preview import-load-data.php cross site scriptingEPSS 0.6%CVE-2022-3733MEDIUMSourceCodester Web-Based Student Clearance System edit-admin.php sql injectionEPSS 0.6%CVE-2025-1611MEDIUMShopXO Template ThemeAdminService.php injectionEPSS 0.6%CVE-2024-10700MEDIUMcode-projects University Event Management System submit.php sql injectionEPSS 0.6%CVE-2021-4244LOWyikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scriptingEPSS 0.6%