Weaknesses of type CWE-707
256 resultsNeutralização Inadequada de Entrada
A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.
Example
Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).
How to mitigate
Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.
CVE-2022-4091LOWSourceCodester Canteen Management System food.php query cross site scriptingEPSS 0.4%CVE-2022-4253LOWSourceCodester Canteen Management System customer.php builtin_echo cross site scriptingEPSS 0.4%CVE-2020-36621LOWchedabob whatismyudid mobileconfig.js exports.enrollment cross site scriptingEPSS 0.4%CVE-2022-4252LOWSourceCodester Canteen Management System categories.php builtin_echo cross site scriptingEPSS 0.4%CVE-2022-4341LOWcsliuwy coder-chain_gdut cross site scriptingEPSS 0.4%CVE-2022-4234LOWSourceCodester Canteen Management System brand.php builtin_echo cross site scriptingEPSS 0.4%CVE-2024-10841MEDIUMromadebrian WEB-Sekolah Mail Proses_Kirim.php sql injectionEPSS 0.4%CVE-2022-3963LOWgnuboard5 FAQ Key ID faq.php cross site scriptingEPSS 0.4%CVE-2022-3968LOWemlog article_save.php cross site scriptingEPSS 0.4%CVE-2024-10806MEDIUMPHPGurukul Hospital Management System betweendates-detailsreports.php cross site scriptingEPSS 0.4%CVE-2024-10807MEDIUMPHPGurukul Hospital Management System search.php cross site scriptingEPSS 0.4%CVE-2024-10842MEDIUMromadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scriptingEPSS 0.4%CVE-2022-4250LOWMovie Ticket Booking System booking.php cross site scriptingEPSS 0.4%CVE-2022-3714MEDIUMSourceCodester Online Medicine Ordering System sql injectionEPSS 0.4%CVE-2022-4348LOWy_project RuoYi-Cloud JSON cross site scriptingEPSS 0.4%CVE-2022-4350LOWMingsoft MCMS search.do cross site scriptingEPSS 0.4%CVE-2022-4640LOWMingsoft MCMS Article save cross site scriptingEPSS 0.4%CVE-2022-4251LOWMovie Ticket Booking System editBooking.php cross site scriptingEPSS 0.4%CVE-2026-4500MEDIUMbagofwords1 bagofwords code_execution.py generate_df injectionEPSS 0.4%CVE-2022-4347LOWxiandafu beetl-bbs WebUtils.java cross site scriptingEPSS 0.4%