Falhas do tipo CWE-943

108 resultados

Neutralização inadequada de caracteres especiais em lógica de consulta de dados

Ocorre quando a aplicação não sanitiza adequadamente dados do usuário antes de usá-los em consultas (SQL, LDAP, XPath, etc.), permitindo que caracteres ou sequências especiais sejam interpretados como parte da sintaxe da consulta. Um atacante injeta comandos ou operadores que modificam a lógica esperada, contornando filtros de autenticação ou acessando dados não autorizados.

Exemplo

Um login que concatena diretamente a entrada do usuário em uma query LDAP: filter = '(uid=' + username + ')'. Se o atacante digitar 'admin*', a busca retorna qualquer usuário com uid começando em 'admin', contornando validação de senha. Ou em SQL, inserir aspas e operadores booleanos para alterar o WHERE da consulta.

Como mitigar

Use prepared statements ou consultas parametrizadas (placeholders) em vez de concatenação de strings. Para LDAP e XPath, aplique escape de caracteres especiais conforme o padrão da tecnologia. Valide e restrinja entrada do usuário a um whitelist de valores esperados sempre que possível.

CVE-2026-79483MEDIUMFastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unaEPSS 0.4%CVE-2026-53674HIGHBuddyPress 14.4.0 REGEXP Injection via @Mention Username ResolutionEPSS 0.4%CVE-2026-32247HIGHGraphiti vulnerable to Cypher Injection via unsanitized node_labels in search filtersEPSS 0.3%CVE-2026-42316MEDIUMKQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kustoEPSS 0.3%CVE-2026-63138MEDIUMImproper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information DisclosureEPSS 0.3%CVE-2026-34973MEDIUMphpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content DisclosureEPSS 0.3%CVE-2026-56096MEDIUMInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2026-3023MEDIUMNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application webEPSS 0.3%CVE-2026-88025MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# DriverEPSS 0.3%CVE-2026-88024MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust DriverEPSS 0.3%CVE-2026-88023MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP LibraryEPSS 0.3%CVE-2026-76254HIGHSPL Command Safeguards Bypass through Splunk Web in Splunk EnterpriseEPSS 0.3%CVE-2025-33114MEDIUMIBM Db2 for Linux denial of serviceEPSS 0.3%CVE-2026-47835HIGHSpring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector StoresEPSS 0.3%CVE-2026-76316HIGHStored SPL Injection through Deployment Server Broker Registration in Splunk EnterpriseEPSS 0.3%CVE-2026-88022HIGHUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelEPSS 0.3%CVE-2026-40102MEDIUMPlane: ORM Field Reference Injection via `segment` Parameter in Saved AnalyticsEPSS 0.3%CVE-2026-73618HIGHBudibase Server before 3.40.0 NoSQL Injection via JSON ParameterEPSS 0.3%CVE-2026-76363MEDIUMStructured Query Language Injection through the REST API in Splunk SOAREPSS 0.3%CVE-2026-42156HIGHFlowsint: Cypher query injection in node type on node creationEPSS 0.3%