Weaknesses of type CWE-707
256 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2023-6123HIGHImproper Neutralization vulnerability affects OpenText ALM Octane.EPSS 0.5%CVE-2022-4602LOWShoplazza LifeStyle Review Flow cross site scriptingEPSS 0.5%CVE-2022-4600LOWShoplazza LifeStyle Product Carousel cross site scriptingEPSS 0.5%CVE-2022-4598LOWShoplazza LifeStyle Announcement cross site scriptingEPSS 0.5%CVE-2022-4599LOWShoplazza LifeStyle Product cross site scriptingEPSS 0.5%CVE-2021-4274LOWsileht bird-lg layout.html cross site scriptingEPSS 0.5%CVE-2022-4601LOWShoplazza LifeStyle Shipping/Member Discount/Icon cross site scriptingEPSS 0.5%CVE-2022-4591LOWmschaef toto Email Parameter cross site scriptingEPSS 0.5%CVE-2022-4582LOWstarter-public-edition-4 cross site scriptingEPSS 0.5%CVE-2022-4595LOWdjango-openipam exposed_hosts.html cross site scriptingEPSS 0.5%CVE-2024-10808MEDIUMcode-projects E-Health Care System req_detail.php sql injectionEPSS 0.5%CVE-2024-10809MEDIUMcode-projects E-Health Care System chat.php sql injectionEPSS 0.5%CVE-2022-4585LOWOpencaching Deutschland oc-server3 Cookie start.tpl cross site scriptingEPSS 0.5%CVE-2022-4586LOWOpencaching Deutschland oc-server3 Cachelist cachelists.tpl cross site scriptingEPSS 0.5%CVE-2022-3868MEDIUMSourceCodester Sanitization Management System sql injectionEPSS 0.5%CVE-2022-4454MEDIUMm0ver bible-online Search search.java query sql injectionEPSS 0.5%CVE-2022-3992LOWSourceCodester Sanitization Management System Banner Image cross site scriptingEPSS 0.5%CVE-2022-3587LOWSourceCodester Simple Cold Storage Management System My Account cross site scriptingEPSS 0.5%CVE-2022-4590LOWmschaef toto Todo List cross site scriptingEPSS 0.5%CVE-2022-4587MEDIUMOpencaching Deutschland oc-server3 Login Page login.tpl cross site scriptingEPSS 0.5%