User-provided inputs must be sanitized before being used to generate a SQL database query. An attacker can create and use untrusted input to run query statements that read, modify, or delete database content.

SQL Injection

The use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database.

Unneutralized or incorrectly neutralized output in logs can potentially lead to log forging or the injection of malicious content.

Log Injection

User-controllable input must be sanitized before it's included in output used to dynamically generate a web page. Unsanitized user input can introduce cross-side scripting (XSS) vulnerabilities that can lead to inadvertedly running malicious code in a trusted context.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

OS command injection is a critical vulnerability that can lead to a full system compromise as it may allow an adversary to pass in arbitrary commands or arguments to be executed.

OS command injection

OS command injection from untrusted input.

Use of unsanitized external input in reflection can allow attackers to bypass security checks and run malicious code.

Unsafe Reflection

Use of externally-controlled input in reflection.

Amazon Q

Detector Library

PHP detectors (37/37)

Tag: injection

SQL Injection

Log Injection

Cross-site scripting

OS command injection

Unsafe Reflection