Fallos del tipo CWE-74

4786 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-5669MEDIUMPHPGurukul Medical Card Generation System unreadenq.php sql injectionEPSS 0.5%CVE-2025-6609MEDIUMSourceCodester Best Salon Management System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2026-12717CRITICALRemote Code Execution in BigQuery Data Transfer Service via JDBC Connection String InjectionEPSS 0.5%CVE-2025-6414MEDIUMPHPGurukul Art Gallery Management System changeimage2.php sql injectionEPSS 0.5%CVE-2025-6608MEDIUMSourceCodester Best Salon Management System edit-services.php sql injectionEPSS 0.5%CVE-2025-5659MEDIUMPHPGurukul Complaint Management System profile.php sql injectionEPSS 0.5%CVE-2025-5652MEDIUMPHPGurukul Complaint Management System between-date-complaintreport.php sql injectionEPSS 0.5%CVE-2025-6606MEDIUMSourceCodester Best Salon Management System add-services.php sql injectionEPSS 0.5%CVE-2025-6413MEDIUMPHPGurukul Art Gallery Management System changeimage1.php sql injectionEPSS 0.5%CVE-2025-6410MEDIUMPHPGurukul Art Gallery Management System edit-art-medium-detail.php sql injectionEPSS 0.5%CVE-2025-6417MEDIUMPHPGurukul Art Gallery Management System add-artist.php sql injectionEPSS 0.5%CVE-2025-5670MEDIUMPHPGurukul Medical Card Generation System manage-card.php sql injectionEPSS 0.5%CVE-2025-5857MEDIUMcode-projects Patient Record Management System urinalysis_record.php sql injectionEPSS 0.5%CVE-2025-6604MEDIUMSourceCodester Best Salon Management System add-staff.php sql injectionEPSS 0.5%CVE-2025-5660MEDIUMPHPGurukul Complaint Management System register-complaint.php sql injectionEPSS 0.5%CVE-2025-5668MEDIUMPHPGurukul Medical Card Generation System readenq.php sql injectionEPSS 0.5%CVE-2025-6570MEDIUMPHPGurukul Hospital Management System search.php sql injectionEPSS 0.5%CVE-2025-6411MEDIUMPHPGurukul Art Gallery Management System changepropic.php sql injectionEPSS 0.5%CVE-2025-6581MEDIUMSourceCodester Best Salon Management System add-customer.php sql injectionEPSS 0.5%CVE-2025-5614MEDIUMPHPGurukul Online Fire Reporting System search-report-result.php sql injectionEPSS 0.5%