Falhas do tipo CWE-1336

301 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, tokens, arquivos internos, estrutura do sistema) a usuários ou atacantes que não deveriam acessá-los. Isso ocorre por falta de controle de acesso adequado, validação insuficiente ou exposição acidental de dados em logs, mensagens de erro ou respostas HTTP.

Exemplo

Um site exibe mensagens de erro detalhadas que revelam caminhos de arquivos e versões de banco de dados; ou uma API retorna dados de outros usuários porque não valida permissões; ou credenciais ficam expostas em comentários do código-fonte publicado.

Como mitigar

Implemente controle de acesso granular (verificar quem acessa o quê); sanitize mensagens de erro (mostrar genéricas ao usuário, logs detalhados apenas internamente); revise e restrinja dados retornados por APIs; escaneie repositórios e logs de produção para credenciais expostas.

CVE-2026-54662HIGHswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client templateEPSS 0.3%CVE-2026-78164HIGHApache Camel: HTTP producers resolve property placeholders in message-supplied URI override headersEPSS 0.3%CVE-2025-66435MEDIUMAn SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The funEPSS 0.3%CVE-2025-66436MEDIUMAn SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The EPSS 0.3%CVE-2026-44916LOWIn OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.EPSS 0.3%CVE-2026-34587HIGHKirby has Server-Side Template Injection (SSTI) via double template resolution in option renderingEPSS 0.3%CVE-2026-5559MEDIUMAntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template engineEPSS 0.3%CVE-2026-34724HIGHZammad has a server-side template injection leading to RCE via AI AgentEPSS 0.3%CVE-2025-46699MEDIUMDell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulEPSS 0.3%CVE-2024-57177HIGHA host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header EPSS 0.3%CVE-2026-19584HIGHVelociraptor VQL injection during notebook restore from backupEPSS 0.3%CVE-2025-9094MEDIUMThingsBoard Add Gateway special elements used in a template engineEPSS 0.3%CVE-2025-66361MEDIUMAn issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPEPSS 0.3%CVE-2026-119144HIGHFrappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message FieldsEPSS 0.3%CVE-2026-109652HIGHFrappe ERPNext before 15.119.1 Server-Side Template Injection via Message FieldsEPSS 0.3%CVE-2026-27464HIGHMetabase: Server-Side Template Injection via Notifications Endpoint Leads to RCEEPSS 0.3%CVE-2026-6984MEDIUMAstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engineEPSS 0.3%CVE-2026-3714MEDIUMOpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engineEPSS 0.3%CVE-2026-9498MEDIUMDromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engineEPSS 0.3%CVE-2026-26938HIGHImproper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)EPSS 0.3%