Falhas do tipo CWE-943

150 resultados

Neutralização inadequada de caracteres especiais em lógica de consulta de dados

Ocorre quando a aplicação não sanitiza adequadamente dados do usuário antes de usá-los em consultas (SQL, LDAP, XPath, etc.), permitindo que caracteres ou sequências especiais sejam interpretados como parte da sintaxe da consulta. Um atacante injeta comandos ou operadores que modificam a lógica esperada, contornando filtros de autenticação ou acessando dados não autorizados.

Exemplo

Um login que concatena diretamente a entrada do usuário em uma query LDAP: filter = '(uid=' + username + ')'. Se o atacante digitar 'admin*', a busca retorna qualquer usuário com uid começando em 'admin', contornando validação de senha. Ou em SQL, inserir aspas e operadores booleanos para alterar o WHERE da consulta.

Como mitigar

Use prepared statements ou consultas parametrizadas (placeholders) em vez de concatenação de strings. Para LDAP e XPath, aplique escape de caracteres especiais conforme o padrão da tecnologia. Valide e restrinja entrada do usuário a um whitelist de valores esperados sempre que possível.

CVE-2026-88031MEDIUMGridFS data deletion via query-operator injection in file IDs in the MongoDB Go DriverEPSS 0.5%CVE-2026-88024MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust DriverEPSS 0.5%CVE-2026-88025MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# DriverEPSS 0.5%CVE-2026-81914MEDIUMApache Airflow Google provider: Google Drive query injection via unescaped file and folder namesEPSS 0.5%CVE-2026-63214HIGHSuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest apiEPSS 0.5%CVE-2026-91937HIGHFlowise before 3.1.4 NoSQL Injection via sessionIdEPSS 0.5%CVE-2026-63138MEDIUMImproper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information DisclosureEPSS 0.5%CVE-2026-8649MEDIUMInstitution scope bypass vulnerability in custom reportsEPSS 0.5%CVE-2026-106119MEDIUMLangChain: MongoDBChatMessageHistory query injection can allow cross-session accessEPSS 0.5%CVE-2026-88033MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java DriverEPSS 0.5%CVE-2026-88034MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ DriverEPSS 0.5%CVE-2026-114401MEDIUMTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/loginEPSS 0.4%CVE-2026-100365HIGHSuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated UserEPSS 0.4%CVE-2025-36442MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2026-88022HIGHUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelEPSS 0.4%CVE-2026-56096MEDIUMInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.4%CVE-2026-88028HIGHUnauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for LaravelEPSS 0.4%CVE-2025-60357HIGHAhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.EPSS 0.4%CVE-2026-76254HIGHSPL Command Safeguards Bypass through Splunk Web in Splunk EnterpriseEPSS 0.4%CVE-2026-41328CRITICALDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang FieldEPSS 0.4%