Weaknesses of type CWE-707
262 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2022-4416MEDIUMRainyGao DocSys getReposAllUsers.do getReposAllUsers sql injectionEPSS 0.5%CVE-2022-4015MEDIUMSports Club Management System make_payments.php sql injectionEPSS 0.5%CVE-2022-4444LOWipti br.tag cross site scriptingEPSS 0.5%CVE-2022-4248MEDIUMMovie Ticket Booking System editBooking.php sql injectionEPSS 0.5%CVE-2022-3992LOWSourceCodester Sanitization Management System Banner Image cross site scriptingEPSS 0.5%CVE-2023-6123HIGHImproper Neutralization vulnerability affects OpenText ALM Octane.EPSS 0.5%CVE-2021-4265LOWsiwapp-ror cross site scriptingEPSS 0.5%CVE-2022-4592MEDIUMluckyshot CRMx index.php commentdelete sql injectionEPSS 0.5%CVE-2021-4269LOWSimpleRisk common.js checkAndSetValidation cross site scriptingEPSS 0.5%CVE-2021-4267LOWtad_discuss cross site scriptingEPSS 0.5%CVE-2024-10808MEDIUMcode-projects E-Health Care System req_detail.php sql injectionEPSS 0.5%CVE-2024-10809MEDIUMcode-projects E-Health Care System chat.php sql injectionEPSS 0.5%CVE-2020-36608LOWTribal Systems Zenario CMS Error Log Module admin_organizer.js cross site scriptingEPSS 0.5%CVE-2021-4252LOWWP-Ban ban-options.php toggle_checkbox cross site scriptingEPSS 0.5%CVE-2026-20278HIGHCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.5%CVE-2025-0697MEDIUMTelstra Smart Modem Gen 2 HTTP Header injectionEPSS 0.5%CVE-2022-4053LOWStudent Attendance Management System createClass.php cross site scriptingEPSS 0.5%CVE-2022-3452LOWSourceCodester Book Store Management System category.php cross site scriptingEPSS 0.5%CVE-2024-10810MEDIUMcode-projects E-Health Care System app_request.php sql injectionEPSS 0.5%CVE-2022-4726MEDIUMSourceCodester Sanitization Management System Admin Login sql injectionEPSS 0.5%