Fallos del tipo CWE-74

4788 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-82615MEDIUMitsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injectionEPSS 0.4%CVE-2026-75080MEDIUMSourceCodester Class and Exam Timetabling System edit_subject1.php sql injectionEPSS 0.4%CVE-2026-14743MEDIUMcode-projects Real State Services normalHomeSale.php sql injectionEPSS 0.4%CVE-2026-14747MEDIUMcode-projects Real State Services addprojectsale.php sql injectionEPSS 0.4%CVE-2026-19919MEDIUMcode-projects Online Shopping System Login login.php sql injectionEPSS 0.4%CVE-2026-14640MEDIUMCodeAstro Apartment Visitor Management System Login index.php sql injectionEPSS 0.4%CVE-2026-19231MEDIUMSourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injectionEPSS 0.4%CVE-2026-75986MEDIUMcode-projects Online Job Portal System Password Recovery ForPass.php sql injectionEPSS 0.4%CVE-2026-78201MEDIUMitsourcecode Payroll System admin_class.php login sql injectionEPSS 0.4%CVE-2026-15703MEDIUMSourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injectionEPSS 0.4%CVE-2026-76996MEDIUMSourceCodester Simple Online Food Ordering System view_order.php sql injectionEPSS 0.4%CVE-2025-2740MEDIUMPHPGurukul Old Age Home Management System eligibility.php sql injectionEPSS 0.4%CVE-2026-14746MEDIUMcode-projects Real State Services addprojectrent.php sql injectionEPSS 0.4%CVE-2026-93979MEDIUMcode-projects Internship Management System login.php sql injectionEPSS 0.4%CVE-2026-15597MEDIUMSourceCodester Class and Exam Timetabling System edit_exam2.php sql injectionEPSS 0.4%CVE-2026-86213MEDIUMMstfakts College-Management-System Search university.php mysqli_query sql injectionEPSS 0.4%CVE-2026-16484MEDIUMSourceCodester Class and Exam Timetabling System edit_subjecta.php sql injectionEPSS 0.4%CVE-2026-14653MEDIUMSourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injectionEPSS 0.4%CVE-2026-86225MEDIUMSourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injectionEPSS 0.4%CVE-2026-76990MEDIUMcode-projects Simple Inventory System delete.php sql injectionEPSS 0.4%