Falhas do tipo CWE-943

150 resultados

Neutralização inadequada de caracteres especiais em lógica de consulta de dados

Ocorre quando a aplicação não sanitiza adequadamente dados do usuário antes de usá-los em consultas (SQL, LDAP, XPath, etc.), permitindo que caracteres ou sequências especiais sejam interpretados como parte da sintaxe da consulta. Um atacante injeta comandos ou operadores que modificam a lógica esperada, contornando filtros de autenticação ou acessando dados não autorizados.

Exemplo

Um login que concatena diretamente a entrada do usuário em uma query LDAP: filter = '(uid=' + username + ')'. Se o atacante digitar 'admin*', a busca retorna qualquer usuário com uid começando em 'admin', contornando validação de senha. Ou em SQL, inserir aspas e operadores booleanos para alterar o WHERE da consulta.

Como mitigar

Use prepared statements ou consultas parametrizadas (placeholders) em vez de concatenação de strings. Para LDAP e XPath, aplique escape de caracteres especiais conforme o padrão da tecnologia. Valide e restrinja entrada do usuário a um whitelist de valores esperados sempre que possível.

CVE-2026-46591HIGHApache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)EPSS 0.5%CVE-2026-54350CRITICALBudibase: Anonymous NoSQL operator injection via published-app query templatesEPSS 0.5%CVE-2026-20284CRITICALCisco Identity Search Engine SXP REST API SQL Injection VulnerabilityEPSS 0.5%CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.5%CVE-2026-55253HIGHLangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureEPSS 0.5%CVE-2026-40141HIGHHigh-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2026-44840HIGHDgraph Vulnerable to DQL Injection via checkUserPassword GraphQL QueryEPSS 0.5%CVE-2026-45689CRITICALRocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATOEPSS 0.5%CVE-2026-25514HIGHFacturaScripts has SQL Injection vulnerability in Autocomplete ActionsEPSS 0.5%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2026-30941HIGHParse Server has a NoSQL injection via token type in password reset and email verification endpointsEPSS 0.5%CVE-2026-77070HIGHn8n before 1.123.69 NoSQL Injection via MongoDB NodeEPSS 0.5%CVE-2026-29793CRITICALNoSQL Injection via WebSocket id Parameter in MongoDB AdapterEPSS 0.5%CVE-2026-41274CRITICALFlowise: Cypher Injection in GraphCypherQAChainEPSS 0.5%CVE-2026-76316HIGHStored SPL Injection through Deployment Server Broker Registration in Splunk EnterpriseEPSS 0.5%CVE-2026-114396HIGHTrudesk through 1.2.11 MongoDB $where Injection via tickets search APIEPSS 0.5%CVE-2024-4872CRITICALA vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attackEPSS 0.5%CVE-2026-45688CRITICALRocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session HijackEPSS 0.5%CVE-2026-41327CRITICALDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldEPSS 0.5%CVE-2026-81525HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP DriverEPSS 0.5%