Fallos del tipo CWE-707

256 resultados

Neutralização inadequada de entrada

Fraqueza genérica onde o software falha em remover ou neutralizar caracteres, sequências ou padrões perigosos antes de usar dados de entrada em contextos sensíveis (SQL, HTML, comandos do sistema). O risco é que um atacante injete código malicioso através desses dados não filtrados.

Ejemplo

Um formulário web que concatena diretamente a entrada do usuário em uma query SQL sem escapar aspas ou semicolons; um atacante envia `'; DROP TABLE users; --` e consegue deletar dados. Ou um campo de nome que aceita `<script>` e executa JavaScript no navegador de outros usuários.

Cómo mitigar

Use parametrização (prepared statements) para SQL, escape apropriado para cada contexto (HTML, URL, JS), validação de entrada com whitelist e bibliotecas especializadas (como ESAPI). Nunca concatene dados brutos em comandos ou markup.

CVE-2022-3519LOWSourceCodester Sanitization Management System Quote Requests Tab cross site scriptingEPSS 0.4%CVE-2022-4401LOWpallidlight online-course-selection-system cross site scriptingEPSS 0.4%CVE-2022-4249LOWMovie Ticket Booking System POST Request cross site scriptingEPSS 0.4%CVE-2022-4353LOWLinZhaoguan pb-cms IpUtil.getIpAddr cross site scriptingEPSS 0.4%CVE-2022-4456LOWfalling-fruit cross site scriptingEPSS 0.4%CVE-2022-4561LOWSemanticDrilldown Extension GET Parameter SDBrowseDataPage.php printFilterLine cross site scriptingEPSS 0.4%CVE-2022-3497LOWSourceCodester Human Resource Management System Master List cross site scriptingEPSS 0.4%CVE-2022-3493LOWSourceCodester Human Resource Management System Add Employee cross site scriptingEPSS 0.4%CVE-2024-10840MEDIUMromadebrian WEB-Sekolah Backend akun_edit.php cross site scriptingEPSS 0.4%CVE-2026-3813MEDIUMopencc JFlow WF_CCForm.java Calculate injectionEPSS 0.4%CVE-2022-3581LOWSourceCodester Cashier Queuing System Cashiers Tab cross site scriptingEPSS 0.4%CVE-2022-3580LOWSourceCodester Cashier Queuing System User Creation cross site scriptingEPSS 0.4%CVE-2022-3672LOWSourceCodester Sanitization Management System SystemSettings.php cross site scriptingEPSS 0.4%CVE-2022-3673LOWSourceCodester Sanitization Management System Master.php cross site scriptingEPSS 0.4%CVE-2022-3716LOWSourceCodester Online Medicine Ordering System cross site scriptingEPSS 0.4%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.3%CVE-2021-4271LOWpanicsteve w2wiki Markdown index.php toHTML cross site scriptingEPSS 0.3%CVE-2021-4270LOWImprint CMS ViewHelpers.cs SearchForm cross site scriptingEPSS 0.3%CVE-2022-4233LOWSourceCodester Event Registration System cross site scriptingEPSS 0.3%CVE-2024-21864HIGHImproper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated usEPSS 0.3%