Fallos del tipo CWE-74

4782 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-9789MEDIUMSourceCodester Online Hotel Reservation System edituser.php sql injectionEPSS 0.5%CVE-2025-10687MEDIUMSourceCodester Responsive E-Learning System add_teacher.php sql injectionEPSS 0.5%CVE-2025-11062MEDIUMCampcodes Online Learning Management System save_student.php sql injectionEPSS 0.5%CVE-2025-11061MEDIUMCampcodes Online Learning Management System edit_student.php sql injectionEPSS 0.5%CVE-2025-10800MEDIUMitsourcecode Online Discussion Forum index.php sql injectionEPSS 0.5%CVE-2025-11432MEDIUMitsourcecode Leave Management System reset.php sql injectionEPSS 0.5%CVE-2025-11076MEDIUMCampcodes Online Learning Management System edit_teacher.php sql injectionEPSS 0.5%CVE-2025-11057MEDIUMSourceCodester Pet Grooming Management Software print_inv.php sql injectionEPSS 0.5%CVE-2025-10104MEDIUMcode-projects Online Event Judging System review_search.php sql injectionEPSS 0.5%CVE-2025-11424MEDIUMcode-projects Web-Based Inventory and POS System login.php sql injectionEPSS 0.5%CVE-2025-10031MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.5%CVE-2026-54662HIGHswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client templateEPSS 0.5%CVE-2026-54664HIGHswagger-typescript-api vulnerable to code injection via unescaped enum string valuesEPSS 0.5%CVE-2026-54661HIGHswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client templateEPSS 0.5%CVE-2026-54666HIGHswagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodiesEPSS 0.5%CVE-2025-8185MEDIUM1000 Projects ABC Courier Management System getbyid.php sql injectionEPSS 0.5%CVE-2025-2046MEDIUMSourceCodester Best Employee Management System print1.php sql injectionEPSS 0.5%CVE-2026-24010HIGHHorilla has HTML Injection Issue that, with Phishing, Leads to Account TakeoverEPSS 0.5%CVE-2025-5632MEDIUMcode-projects/anirbandutta9 Content Management System/News-Buzz users.php sql injectionEPSS 0.5%CVE-2025-5633MEDIUMcode-projects/anirbandutta9 Content Management System/News-Buzz users.php sql injectionEPSS 0.5%