Fallos del tipo CWE-74

4787 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-82613MEDIUMitsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injectionEPSS 0.4%CVE-2026-19710MEDIUMSourceCodester Simple Student Information System view_department.php sql injectionEPSS 0.4%CVE-2026-14649MEDIUMcode-projects Online Voting System saveVote.php test_input sql injectionEPSS 0.4%CVE-2026-93974MEDIUMSourceCodester Online Reviewer Management System btn_functions.php remove sql injectionEPSS 0.4%CVE-2026-14713MEDIUMSourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injectionEPSS 0.4%CVE-2026-86220MEDIUMSourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injectionEPSS 0.4%CVE-2026-14768MEDIUMcode-projects Real State Services builderHome.php sql injectionEPSS 0.4%CVE-2026-85187MEDIUMitsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injectionEPSS 0.4%CVE-2026-93997MEDIUMSourceCodester Drug Recommendation System edit_symptom.php sql injectionEPSS 0.4%CVE-2026-82612MEDIUMitsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injectionEPSS 0.4%CVE-2026-13526MEDIUMSourceCodester Class and Exam Timetabling System edit_class.php sql injectionEPSS 0.4%CVE-2026-78246MEDIUMitsourcecode Online Clinic Management System Admin Login login.php sql injectionEPSS 0.4%CVE-2026-75778MEDIUMcode-projects Task Management System Login Form index.php select_with_multiple_condition sql injectionEPSS 0.4%CVE-2026-15703MEDIUMSourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injectionEPSS 0.4%CVE-2026-76998MEDIUMSourceCodester Simple Online Food Ordering System ajax.php delete_category sql injectionEPSS 0.4%CVE-2026-90789MEDIUMitsourcecode Leave Management System login.php sql injectionEPSS 0.4%CVE-2026-13487MEDIUMSourceCodester Class and Exam Timetabling System archive.php sql injectionEPSS 0.4%CVE-2026-19196MEDIUMSourceCodester Photo Share Website ajax.php login sql injectionEPSS 0.4%CVE-2026-91848MEDIUMWuzhiCMS index.php getDataOfJson sql injectionEPSS 0.4%CVE-2026-85516MEDIUMcode-projects Vehicle Management System busprofile.php sql injectionEPSS 0.4%