Weaknesses of type CWE-707

262 results

Neutralização Inadequada de Entrada

A aplicação falha em sanitizar, validar ou escapar dados de entrada antes de usá-los em contextos sensíveis (SQL, HTML, comandos do sistema, etc.). Isso permite que um atacante injete código ou comandos maliciosos que serão executados com privilégios da aplicação.

Example

Um formulário web que recebe um nome de usuário e o insere direto em uma query SQL sem usar prepared statements: `SELECT * FROM users WHERE name = '` + input + `'`. Um atacante entra `' OR '1'='1` e consegue listar todos os usuários (SQL injection).

How to mitigate

Use prepared statements/parameterized queries, escape caracteres especiais conforme o contexto (HTML, SQL, URL), implemente whitelist de valores aceitos e valide entrada no servidor. Nunca confie em dados do cliente.

CVE-2022-3714MEDIUMSourceCodester Online Medicine Ordering System sql injectionEPSS 0.5%CVE-2026-20330CRITICALCisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization VulnerabilitiesEPSS 0.5%CVE-2020-36621LOWchedabob whatismyudid mobileconfig.js exports.enrollment cross site scriptingEPSS 0.5%CVE-2022-3950LOWsanluan PublicCMS Tab dwz.min.js initLink cross site scriptingEPSS 0.5%CVE-2022-4234LOWSourceCodester Canteen Management System brand.php builtin_echo cross site scriptingEPSS 0.5%CVE-2022-4091LOWSourceCodester Canteen Management System food.php query cross site scriptingEPSS 0.5%CVE-2022-4252LOWSourceCodester Canteen Management System categories.php builtin_echo cross site scriptingEPSS 0.5%CVE-2022-4253LOWSourceCodester Canteen Management System customer.php builtin_echo cross site scriptingEPSS 0.5%CVE-2024-10841MEDIUMromadebrian WEB-Sekolah Mail Proses_Kirim.php sql injectionEPSS 0.4%CVE-2022-4421LOWrAthena FluxCP Service Desk Image URL view.php cross site scriptingEPSS 0.4%CVE-2022-4250LOWMovie Ticket Booking System booking.php cross site scriptingEPSS 0.4%CVE-2022-4341LOWcsliuwy coder-chain_gdut cross site scriptingEPSS 0.4%CVE-2024-10806MEDIUMPHPGurukul Hospital Management System betweendates-detailsreports.php cross site scriptingEPSS 0.4%CVE-2024-10842MEDIUMromadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scriptingEPSS 0.4%CVE-2024-10807MEDIUMPHPGurukul Hospital Management System search.php cross site scriptingEPSS 0.4%CVE-2022-3963LOWgnuboard5 FAQ Key ID faq.php cross site scriptingEPSS 0.4%CVE-2022-4251LOWMovie Ticket Booking System editBooking.php cross site scriptingEPSS 0.4%CVE-2022-4640LOWMingsoft MCMS Article save cross site scriptingEPSS 0.4%CVE-2022-3453LOWSourceCodester Book Store Management System transcation.php cross site scriptingEPSS 0.4%CVE-2026-76284CRITICALImproper Neutralization in Splunk EnterpriseEPSS 0.4%