Weaknesses of type CWE-99

61 results

Injeção de Recurso

Ocorre quando a aplicação constrói caminhos de arquivo, URLs, nomes de banco de dados ou outros identificadores de recurso usando entrada do usuário sem validação adequada. Um atacante manipula essas entradas para acessar ou modificar recursos não pretendidos, como arquivos sensíveis, bancos de dados alternativos ou serviços internos.

Example

Uma aplicação web que carrega templates com base no parâmetro `?template=contato` é vulnerável se simplesmente concatenar a entrada: `load_template('/templates/' + request.param('template'))`. Um atacante passa `?template=../../../etc/passwd` e consegue ler arquivos do sistema.

How to mitigate

Valide e normalize toda entrada de usuário contra uma lista branca de recursos permitidos; nunca concatene entrada diretamente em caminhos ou identificadores. Use APIs seguras que separem metadados (como nomes de recurso) de dados, e implemente controle de acesso camada a camada — mesmo que a injeção aconteça, o acesso ao recurso deve ser negado.

CVE-2025-12918LOWyungifez Skuul School Management System View Fee Invoice fee-invoices resource injectionEPSS 0.4%CVE-2025-3405MEDIUMFCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injectionEPSS 0.4%CVE-2026-13493LOWAIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injectionEPSS 0.4%CVE-2025-9264MEDIUMXuxueli xxl-job Jobs JobInfoController.java remove resource injectionEPSS 0.3%CVE-2025-2125MEDIUMControl iD RH iD PDF Document companyId resource injectionEPSS 0.3%CVE-2020-6245MEDIUMSAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code tEPSS 0.3%CVE-2024-0231LOWImproper Control of Resource Identifiers ('Resource Injection') in GitLabEPSS 0.3%CVE-2026-9438MEDIUMyashpokharna2555 StudentManagementSystem courseDel.php resource injectionEPSS 0.3%CVE-2025-9263MEDIUMXuxueli xxl-job JobLogController.java getJobsByGroup resource injectionEPSS 0.3%CVE-2026-3855LOWImproper Control of Resource Identifiers ('Resource Injection') in GitLabEPSS 0.3%CVE-2026-5414MEDIUMNewgen OmniDocs WebApiRequestRedirection resource injectionEPSS 0.3%CVE-2025-43491HIGHPoly Lens Desktop Application – Privilege EscalationEPSS 0.3%CVE-2026-10299MEDIUMcode-projects Online Hospital Management System viewdoctortimings.php resource injectionEPSS 0.3%CVE-2026-10168MEDIUMOUSL-GROUP-BrinaryBrains School Student Management System Parents.php marks resource injectionEPSS 0.2%CVE-2026-10624MEDIUMSourceCodester Human Resource Management Employee View detailview.php resource injectionEPSS 0.2%CVE-2026-5031MEDIUMBichitroGan ISP Billing Software Endpoint users-view resource injectionEPSS 0.2%CVE-2026-12207MEDIUMmedkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injectionEPSS 0.2%CVE-2026-94149MEDIUMOmega Solution HRM OS Role Permission Retrieval Endpoint permission resource injectionEPSS 0.2%CVE-2026-33603MEDIUMAttacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the atEPSS 0.2%CVE-2026-81521HIGHCross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go DriverEPSS 0.2%