Falhas do tipo CWE-943

108 resultados

Neutralização inadequada de caracteres especiais em lógica de consulta de dados

Ocorre quando a aplicação não sanitiza adequadamente dados do usuário antes de usá-los em consultas (SQL, LDAP, XPath, etc.), permitindo que caracteres ou sequências especiais sejam interpretados como parte da sintaxe da consulta. Um atacante injeta comandos ou operadores que modificam a lógica esperada, contornando filtros de autenticação ou acessando dados não autorizados.

Exemplo

Um login que concatena diretamente a entrada do usuário em uma query LDAP: filter = '(uid=' + username + ')'. Se o atacante digitar 'admin*', a busca retorna qualquer usuário com uid começando em 'admin', contornando validação de senha. Ou em SQL, inserir aspas e operadores booleanos para alterar o WHERE da consulta.

Como mitigar

Use prepared statements ou consultas parametrizadas (placeholders) em vez de concatenação de strings. Para LDAP e XPath, aplique escape de caracteres especiais conforme o padrão da tecnologia. Valide e restrinja entrada do usuário a um whitelist de valores esperados sempre que possível.

CVE-2020-36195CRITICALSQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-OnEPSS 1.8%CVE-2022-36084CRITICALcruddl vulnerable to AQL injection through flexSearchEPSS 1.4%CVE-2021-1349MEDIUMCisco SD-WAN vManage Cypher Query Language Injection VulnerabilityEPSS 1.4%CVE-2018-19952—If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP SystEPSS 1.3%CVE-2020-5257HIGHSort order SQL injection in AdministrateEPSS 0.9%CVE-2021-1481MEDIUMCisco SD-WAN vManage Cypher Query Language Injection VulnerabilityEPSS 0.8%CVE-2021-34712MEDIUMCisco SD-WAN vManage Software Cypher Query Language Injection VulnerabilityEPSS 0.7%CVE-2026-62906HIGHMicrosoft Discovery Studio Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-10698HIGHTable scope bypass vulnerability in custom reportsEPSS 0.6%CVE-2026-32248CRITICALParse Server: Account takeover via operator injection in authentication data identifierEPSS 0.6%CVE-2026-40351CRITICALFastGPT: NoSQL Injection in loginByPassword leads to Authentication BypassEPSS 0.6%CVE-2026-27886CRITICALStrapi may leak sensitive data via relational filtering due to lack of query sanitizationEPSS 0.6%CVE-2024-28192MEDIUMNoSQL Injection Leading to Authentication Bypass in your_spotifyEPSS 0.6%CVE-2025-24787HIGHParameter injection in DB connection URIs leading to local file inclusion in WhoDBEPSS 0.6%CVE-2026-22558HIGHAn Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access toEPSS 0.6%CVE-2024-35136MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2024-31882MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2026-46591HIGHApache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)EPSS 0.5%CVE-2026-54350CRITICALBudibase: Anonymous NoSQL operator injection via published-app query templatesEPSS 0.5%CVE-2026-40141HIGHHigh-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%