Weaknesses of type CWE-707
262 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2022-4601LOWShoplazza LifeStyle Shipping/Member Discount/Icon cross site scriptingEPSS 0.5%CVE-2022-4598LOWShoplazza LifeStyle Announcement cross site scriptingEPSS 0.5%CVE-2022-4585LOWOpencaching Deutschland oc-server3 Cookie start.tpl cross site scriptingEPSS 0.5%CVE-2022-4595LOWdjango-openipam exposed_hosts.html cross site scriptingEPSS 0.5%CVE-2024-10805MEDIUMcode-projects University Event Management System doedit.php sql injectionEPSS 0.5%CVE-2022-4582LOWstarter-public-edition-4 cross site scriptingEPSS 0.5%CVE-2022-4586LOWOpencaching Deutschland oc-server3 Cachelist cachelists.tpl cross site scriptingEPSS 0.5%CVE-2022-4591LOWmschaef toto Email Parameter cross site scriptingEPSS 0.5%CVE-2022-3998MEDIUMMonikaBrzica scm uredi_korisnika.php sql injectionEPSS 0.5%CVE-2022-4247MEDIUMMovie Ticket Booking System booking.php sql injectionEPSS 0.5%CVE-2022-4454MEDIUMm0ver bible-online Search search.java query sql injectionEPSS 0.5%CVE-2022-4012MEDIUMHospital Management Center patient-info.php sql injectionEPSS 0.5%CVE-2022-3949LOWSourcecodester Simple Cashiering System User Account cross site scriptingEPSS 0.5%CVE-2022-3730MEDIUMseccome Ehoney falco sql injectionEPSS 0.5%CVE-2022-4590LOWmschaef toto Todo List cross site scriptingEPSS 0.5%CVE-2022-3731MEDIUMseccome Ehoney token sql injectionEPSS 0.5%CVE-2022-4587MEDIUMOpencaching Deutschland oc-server3 Login Page login.tpl cross site scriptingEPSS 0.5%CVE-2022-3732MEDIUMseccome Ehoney set sql injectionEPSS 0.5%CVE-2022-3729MEDIUMseccome Ehoney attack sql injectionEPSS 0.5%CVE-2022-3333LOWZephyr Project Manager REST Call cross site scriptingEPSS 0.5%