Weaknesses of type CWE-707

256 results

Neutralização Inadequada de Entrada

A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.

Example

Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).

How to mitigate

Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.

CVE-2022-4248MEDIUMMovie Ticket Booking System editBooking.php sql injectionEPSS 0.5%CVE-2022-4444LOWipti br.tag cross site scriptingEPSS 0.5%CVE-2021-4265LOWsiwapp-ror cross site scriptingEPSS 0.5%CVE-2025-0697MEDIUMTelstra Smart Modem Gen 2 HTTP Header injectionEPSS 0.5%CVE-2022-3731MEDIUMseccome Ehoney token sql injectionEPSS 0.5%CVE-2022-3730MEDIUMseccome Ehoney falco sql injectionEPSS 0.5%CVE-2024-10810MEDIUMcode-projects E-Health Care System app_request.php sql injectionEPSS 0.5%CVE-2022-3732MEDIUMseccome Ehoney set sql injectionEPSS 0.5%CVE-2022-3729MEDIUMseccome Ehoney attack sql injectionEPSS 0.5%CVE-2022-4592MEDIUMluckyshot CRMx index.php commentdelete sql injectionEPSS 0.5%CVE-2021-4269LOWSimpleRisk common.js checkAndSetValidation cross site scriptingEPSS 0.5%CVE-2021-4267LOWtad_discuss cross site scriptingEPSS 0.5%CVE-2022-3333LOWZephyr Project Manager REST Call cross site scriptingEPSS 0.5%CVE-2021-4252LOWWP-Ban ban-options.php toggle_checkbox cross site scriptingEPSS 0.5%CVE-2022-4053LOWStudent Attendance Management System createClass.php cross site scriptingEPSS 0.5%CVE-2022-3950LOWsanluan PublicCMS Tab dwz.min.js initLink cross site scriptingEPSS 0.4%CVE-2022-4726MEDIUMSourceCodester Sanitization Management System Admin Login sql injectionEPSS 0.4%CVE-2022-3452LOWSourceCodester Book Store Management System category.php cross site scriptingEPSS 0.4%CVE-2020-36608LOWTribal Systems Zenario CMS Error Log Module admin_organizer.js cross site scriptingEPSS 0.4%CVE-2022-4421LOWrAthena FluxCP Service Desk Image URL view.php cross site scriptingEPSS 0.4%