Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-707 (对消息或数据结构的处理不恰当) — Vulnerability Class 192

192 vulnerabilities classified as CWE-707 (对消息或数据结构的处理不恰当). AI Chinese analysis included.

CWE-707 represents a critical input validation weakness where software fails to properly sanitize structured data before processing or transmission. This flaw typically allows attackers to inject malicious payloads, such as SQL injection strings or cross-site scripting code, by exploiting the system’s inability to distinguish between legitimate data and executable commands. When malformed messages are misinterpreted, they can trigger unintended behaviors, leading to data breaches, system compromise, or denial of service. Developers mitigate this risk by implementing rigorous neutralization techniques, including strict input validation, output encoding, and parameterized queries. By ensuring that all structured messages are well-formed and adhere to expected security properties before being handled by downstream components, engineers can effectively prevent attackers from manipulating the application’s logic and maintain the integrity of the data flow.

MITRE CWE Description
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. If a message is malformed, it may cause the message to be incorrectly interpreted. Neutralization is an abstract term for any technique that ensures that input (and output) conforms with expectations and is "safe." This can be done by: checking that the input/output is already "safe" (e.g. validation) transformation of the input/output to be "safe" using techniques such as filtering, encoding/decoding, escaping/unescaping, quoting/unquoting, or canonicalization preventing the input/output from being directly provided by an attacker (e.g. "indirect selection" that maps externally-provided values to internally-controlled values) preventing the input/output from being processed at all This weakness typically applies in cases where the product prepares a control message that another process must act on, such as a command or query, and malicious input that was intended as data, can enter the control plane instead. However, this weakness also applies to more general cases where there are not always control implications.
Common Consequences (1)
OtherOther
CVE IDTitleCVSSSeverityPublished
CVE-2025-66545 Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin — security-advisories 3.5 Low2025-12-05
CVE-2025-26633 Microsoft Management Console Security Feature Bypass Vulnerability — Windows 10 Version 1507 7.0 High2025-03-11
CVE-2024-43572 Microsoft Management Console Remote Code Execution Vulnerability — Windows 10 Version 1809 7.8 High2024-10-08
CVE-2020-36626 Modern Tribe Panel Builder Plugin SearchFilter.php add_post_content_filtered_to_search_sql sql injection — Panel Builder Plugin 5.5 Medium2022-12-24
CVE-2022-4726 SourceCodester Sanitization Management System Admin Login sql injection — Sanitization Management System 6.3 Medium2022-12-24
CVE-2022-4727 OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting — Appointment Scheduling Module 3.5 Low2022-12-24
CVE-2022-4728 Graphite Web Cookie cross site scripting — Web 3.5 Low2022-12-24
CVE-2022-4729 Graphite Web Template Name cross site scripting — Web 3.5 Low2022-12-24
CVE-2022-4730 Graphite Web Absolute Time Range cross site scripting — Web 3.5 Low2022-12-24
CVE-2021-4274 sileht bird-lg layout.html cross site scripting — bird-lg 3.5 Low2022-12-21
CVE-2022-4631 WP-Ban ban-options.php cross site scripting — WP-Ban 3.5 Low2022-12-21
CVE-2022-4638 collective.contact.widget widgets.py title cross site scripting — collective.contact.widget 3.5 Low2022-12-21
CVE-2022-4640 Mingsoft MCMS Article save cross site scripting — MCMS 3.5 Low2022-12-21
CVE-2022-4642 tatoeba2 Profile Name cross site scripting — tatoeba2 3.5 Low2022-12-21
CVE-2021-4273 studygolang search.go Search cross site scripting — studygolang 4.3 Medium2022-12-21
CVE-2021-4272 studygolang topics.js cross site scripting — studygolang 3.5 Low2022-12-21
CVE-2021-4271 panicsteve w2wiki Markdown index.php toHTML cross site scripting — w2wiki 3.5 Low2022-12-21
CVE-2021-4270 Imprint CMS ViewHelpers.cs SearchForm cross site scripting — Imprint CMS 3.5 Low2022-12-21
CVE-2021-4269 SimpleRisk common.js checkAndSetValidation cross site scripting — SimpleRisk 3.5 Low2022-12-21
CVE-2021-4267 tad_discuss cross site scripting — tad_discuss 3.5 Low2022-12-21
CVE-2021-4265 siwapp-ror cross site scripting — siwapp-ror 3.5 Low2022-12-21
CVE-2020-36621 chedabob whatismyudid mobileconfig.js exports.enrollment cross site scripting — whatismyudid 3.5 Low2022-12-21
CVE-2021-4266 Webdetails cpf DependenciesPackage.java cross site scripting — cpf 3.5 Low2022-12-21
CVE-2021-4262 laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection — laravel-jqgrid 5.5 Medium2022-12-19
CVE-2021-4261 pacman-canvas db-handler.php addHighscore sql injection — pacman-canvas 6.3 Medium2022-12-19
CVE-2022-3877 Click Studios Passwordstate URL Field cross site scripting — Passwordstate 3.5 Low2022-12-19
CVE-2022-4601 Shoplazza LifeStyle Shipping/Member Discount/Icon cross site scripting — LifeStyle 3.5 Low2022-12-18
CVE-2022-4602 Shoplazza LifeStyle Review Flow cross site scripting — LifeStyle 3.5 Low2022-12-18
CVE-2022-4600 Shoplazza LifeStyle Product Carousel cross site scripting — LifeStyle 3.5 Low2022-12-18
CVE-2022-4598 Shoplazza LifeStyle Announcement cross site scripting — LifeStyle 3.5 Low2022-12-18

Vulnerabilities classified as CWE-707 (对消息或数据结构的处理不恰当) represent 192 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.