Weaknesses of type CWE-707
262 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2021-4244LOWyikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scriptingEPSS 0.6%CVE-2022-3868MEDIUMSourceCodester Sanitization Management System sql injectionEPSS 0.6%CVE-2022-4052MEDIUMStudent Attendance Management System createClass.php sql injectionEPSS 0.6%CVE-2021-4273MEDIUMstudygolang search.go Search cross site scriptingEPSS 0.6%CVE-2022-4522LOWCalendarXP cross site scriptingEPSS 0.6%CVE-2025-1611MEDIUMShopXO Template ThemeAdminService.php injectionEPSS 0.6%CVE-2022-4354MEDIUMLinZhaoguan pb-cms Message Board comment cross site scriptingEPSS 0.6%CVE-2024-10700MEDIUMcode-projects University Event Management System submit.php sql injectionEPSS 0.6%CVE-2022-3971MEDIUMmatrix-appservice-irc PgDataStore.ts sql injectionEPSS 0.6%CVE-2022-3975LOWNukeViet CMS Data URL Request.php filterAttr cross site scriptingEPSS 0.6%CVE-2021-4246MEDIUMroxlukas LMeve Login Page sql injectionEPSS 0.6%CVE-2026-4249HIGHDenial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service DisruptionEPSS 0.6%CVE-2022-4523LOWvexim2 cross site scriptingEPSS 0.6%CVE-2022-4526LOWdjango-photologue Default Template photo_detail.html cross site scriptingEPSS 0.6%CVE-2022-4642LOWtatoeba2 Profile Name cross site scriptingEPSS 0.6%CVE-2022-4279LOWSourceCodester Human Resource Management System employeeview.php cross site scriptingEPSS 0.5%CVE-2022-4598LOWShoplazza LifeStyle Announcement cross site scriptingEPSS 0.5%CVE-2022-4599LOWShoplazza LifeStyle Product cross site scriptingEPSS 0.5%CVE-2022-4601LOWShoplazza LifeStyle Shipping/Member Discount/Icon cross site scriptingEPSS 0.5%CVE-2022-4602LOWShoplazza LifeStyle Review Flow cross site scriptingEPSS 0.5%