Fallos del tipo CWE-74

4788 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-15676MEDIUMcode-projects Online Job Portal DeleteUser.php sql injectionEPSS 0.4%CVE-2026-0605MEDIUMcode-projects Online Music Site login.php sql injectionEPSS 0.4%CVE-2026-86161MEDIUMSourceCodester Online Voting System ajax.php delete_category sql injectionEPSS 0.4%CVE-2026-93978MEDIUMcode-projects Internship Management System login.php sql injectionEPSS 0.4%CVE-2026-76762MEDIUMcode-projects Assessment Management welcome.php sql injectionEPSS 0.4%CVE-2026-15134MEDIUMCodeAstro Simple Online Leave Management System index.php sql injectionEPSS 0.4%CVE-2026-15135MEDIUMcode-projects Online Food Order System edit_food_items.php sql injectionEPSS 0.4%CVE-2026-13555MEDIUMitsourcecode Online Hotel Management System controller.php add sql injectionEPSS 0.4%CVE-2026-90846MEDIUMPHPGurukul Daily Expense Tracker System forgot-password.php sql injectionEPSS 0.4%CVE-2026-90515MEDIUMSourceCodester School Registration and Fee System delete_stud.php sql injectionEPSS 0.4%CVE-2026-19899MEDIUMSourceCodester Class and Exam Timetabling System edit_teacher.php sql injectionEPSS 0.4%CVE-2026-94015MEDIUMSourceCodester Drug Recommendation System edit_user.php sql injectionEPSS 0.4%CVE-2026-19021MEDIUMSourceCodester Computer Repair Shop Management System Master.php delete_product sql injectionEPSS 0.4%CVE-2026-86221MEDIUMSourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injectionEPSS 0.4%CVE-2026-14762MEDIUMcode-projects Hotel and Tourism Reservation Room Management rooms.php sql injectionEPSS 0.4%CVE-2026-90805MEDIUMsubhajitkhan online-clinic-management-system doctorlogin.php sql injectionEPSS 0.4%CVE-2026-13527MEDIUMSourceCodester Class and Exam Timetabling System preview4.php sql injectionEPSS 0.4%CVE-2026-85402MEDIUMcode-projects Doctor Appointment System booking.php sql injectionEPSS 0.4%CVE-2026-0607MEDIUMcode-projects Online Music Site AdminViewSongs.php sql injectionEPSS 0.4%CVE-2026-85225MEDIUMcode-projects Doctor Appointment System patient_login.php sql injectionEPSS 0.4%