Falhas do tipo CWE-943

108 resultados

Neutralização inadequada de caracteres especiais em lógica de consulta de dados

Ocorre quando a aplicação não sanitiza adequadamente dados do usuário antes de usá-los em consultas (SQL, LDAP, XPath, etc.), permitindo que caracteres ou sequências especiais sejam interpretados como parte da sintaxe da consulta. Um atacante injeta comandos ou operadores que modificam a lógica esperada, contornando filtros de autenticação ou acessando dados não autorizados.

Exemplo

Um login que concatena diretamente a entrada do usuário em uma query LDAP: filter = '(uid=' + username + ')'. Se o atacante digitar 'admin*', a busca retorna qualquer usuário com uid começando em 'admin', contornando validação de senha. Ou em SQL, inserir aspas e operadores booleanos para alterar o WHERE da consulta.

Como mitigar

Use prepared statements ou consultas parametrizadas (placeholders) em vez de concatenação de strings. Para LDAP e XPath, aplique escape de caracteres especiais conforme o padrão da tecnologia. Valide e restrinja entrada do usuário a um whitelist de valores esperados sempre que possível.

CVE-2026-85167MEDIUMn8n before 2.36.2 Query Injection via Elasticsearch Firestore NodesEPSS 0.2%CVE-2026-82060LOWInsufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image LookupsEPSS 0.2%CVE-2026-48121MEDIUM@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state accessEPSS 0.2%CVE-2026-76331HIGHSPL Injection through the REST API in Splunk EnterpriseEPSS 0.2%CVE-2026-41697MEDIUMSpring Data Relational Parameter not Escaped for Query By Example LIKE PatternEPSS 0.2%CVE-2026-88027HIGHMass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for LaravelEPSS 0.2%CVE-2026-88026HIGHRegular expression injection via unescaped characters in LINQ query translation in MongoDB C# DriverEPSS 0.2%CVE-2026-59319MEDIUMRediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data ExposureEPSS 0.2%CVE-2025-23292MEDIUMNVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an auEPSS 0.2%CVE-2026-3021HIGHNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application webEPSS 0.2%CVE-2026-3022HIGHNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application webEPSS 0.2%CVE-2026-76349MEDIUMSPL Injection through Splunk Web Form Tokens in Splunk EnterpriseEPSS 0.2%CVE-2026-76327MEDIUMSPL Injection through Splunk Web in Splunk Secure GatewayEPSS 0.2%CVE-2026-76320MEDIUMSPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk EnterpriseEPSS 0.2%CVE-2026-73617HIGHBudibase before 3.40.0 NoSQL Injection via MongoDB datasourceEPSS 0.2%CVE-2026-28211HIGHArbitrary code execution in log reader via untrusted log fileEPSS 0.2%CVE-2026-31825MEDIUMSylius has a DQL Injection via API Order FiltersEPSS 0.2%CVE-2026-0504LOWInsufficient Input Handling in JNDI Operations of SAP Identity ManagementEPSS 0.2%CVE-2026-76329MEDIUMSPL Injection through Monitoring Console Dashboard Inputs in Splunk EnterpriseEPSS 0.2%CVE-2026-81527MEDIUMNoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translationEPSS 0.2%