Fallos del tipo CWE-74

4786 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-12336MEDIUMCampcodes Retro Basketball Shoes Online Store admin_index.php sql injectionEPSS 0.5%CVE-2025-12337MEDIUMCampcodes Retro Basketball Shoes Online Store admin_feature.php sql injectionEPSS 0.5%CVE-2025-4109MEDIUMPHPGurukul Pre-School Enrollment System edit-subadmin.php sql injectionEPSS 0.5%CVE-2025-4111MEDIUMPHPGurukul Pre-School Enrollment System visitor-details.php sql injectionEPSS 0.5%CVE-2025-6312MEDIUMCampcodes Sales and Inventory System cash_transaction.php sql injectionEPSS 0.5%CVE-2025-4113MEDIUMPHPGurukul Curfew e-Pass Management System edit-pass-detail.php sql injectionEPSS 0.5%CVE-2025-8157MEDIUMPHPGurukul User Registration & Login and User Management lastthirtyays-reg-users.php sql injectionEPSS 0.5%CVE-2026-3767MEDIUMitsourcecode sanitize or validate this input teacher-attendance.php sql injectionEPSS 0.5%CVE-2025-12338MEDIUMCampcodes Retro Basketball Shoes Online Store admin_product.ph sql injectionEPSS 0.5%CVE-2025-11736MEDIUMitsourcecode Online Examination System index.php sql injectionEPSS 0.5%CVE-2025-6313MEDIUMCampcodes Sales and Inventory System cat_add.php sql injectionEPSS 0.5%CVE-2025-4110MEDIUMPHPGurukul Pre-School Enrollment System edit-teacher.php sql injectionEPSS 0.5%CVE-2026-2223MEDIUMcode-projects Online Reviewer System index.php sql injectionEPSS 0.5%CVE-2025-4155MEDIUMPHPGurukul Boat Booking System edit-boat.php sql injectionEPSS 0.5%CVE-2025-3215MEDIUMPHPGurukul Restaurant Table Booking System add-subadmin.php sql injectionEPSS 0.5%CVE-2025-4156MEDIUMPHPGurukul Boat Booking System change-image.php sql injectionEPSS 0.5%CVE-2025-3205MEDIUMCodeAstro Student Grading System studentsubject.php sql injectionEPSS 0.5%CVE-2025-4080MEDIUMPHPGurukul Online Nurse Hiring System view-request.php sql injectionEPSS 0.5%CVE-2025-4157MEDIUMPHPGurukul Boat Booking System booking-details.php sql injectionEPSS 0.5%CVE-2025-4154MEDIUMPHPGurukul Pre-School Enrollment System enrollment-details.php sql injectionEPSS 0.5%