Weaknesses of type CWE-707

256 results

Neutralização Inadequada de Entrada

A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.

Example

Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).

How to mitigate

Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.

CVE-2022-3998MEDIUMMonikaBrzica scm uredi_korisnika.php sql injectionEPSS 0.5%CVE-2022-4522LOWCalendarXP cross site scriptingEPSS 0.5%CVE-2021-4273MEDIUMstudygolang search.go Search cross site scriptingEPSS 0.5%CVE-2022-3472MEDIUMSourceCodester Human Resource Management System city.php sql injectionEPSS 0.5%CVE-2022-3471MEDIUMSourceCodester Human Resource Management System city.php sql injectionEPSS 0.5%CVE-2022-4012MEDIUMHospital Management Center patient-info.php sql injectionEPSS 0.5%CVE-2022-4279LOWSourceCodester Human Resource Management System employeeview.php cross site scriptingEPSS 0.5%CVE-2022-3467MEDIUMJiusi OA hntdCustomDesktopActionContent sql injectionEPSS 0.5%CVE-2022-3505LOWSourceCodester Sanitization Management System cross site scriptingEPSS 0.5%CVE-2021-4246MEDIUMroxlukas LMeve Login Page sql injectionEPSS 0.5%CVE-2022-3949LOWSourcecodester Simple Cashiering System User Account cross site scriptingEPSS 0.5%CVE-2022-4015MEDIUMSports Club Management System make_payments.php sql injectionEPSS 0.5%CVE-2022-4526LOWdjango-photologue Default Template photo_detail.html cross site scriptingEPSS 0.5%CVE-2022-3442LOWCrealogix EBICS ebics.aspx cross site scriptingEPSS 0.5%CVE-2022-3502LOWHuman Resource Management System Leave cross site scriptingEPSS 0.5%CVE-2022-3503LOWSourceCodester Purchase Order Management System Supplier cross site scriptingEPSS 0.5%CVE-2022-4247MEDIUMMovie Ticket Booking System booking.php sql injectionEPSS 0.5%CVE-2022-4523LOWvexim2 cross site scriptingEPSS 0.5%CVE-2022-4416MEDIUMRainyGao DocSys getReposAllUsers.do getReposAllUsers sql injectionEPSS 0.5%CVE-2022-4642LOWtatoeba2 Profile Name cross site scriptingEPSS 0.5%