Fallos del tipo CWE-74

4788 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-14652MEDIUMSourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injectionEPSS 0.4%CVE-2026-0583MEDIUMcode-projects Online Product Reservation System User Login login.php sql injectionEPSS 0.4%CVE-2026-13498MEDIUMyashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injectionEPSS 0.4%CVE-2026-0585MEDIUMcode-projects Online Product Reservation System GET Parameter order_view.php sql injectionEPSS 0.4%CVE-2026-16152MEDIUMSourceCodester Class and Exam Timetabling System edit_rooma.php sql injectionEPSS 0.4%CVE-2026-86208MEDIUMSourceCodester Class and Exam Timetabling System delete_teacher.php sql injectionEPSS 0.4%CVE-2026-77019MEDIUMCodeAstro Apartment Visitor Management System forgotpw.php sql injectionEPSS 0.4%CVE-2026-75079MEDIUMSourceCodester Class and Exam Timetabling System edit_subject2.php sql injectionEPSS 0.4%CVE-2026-13486MEDIUMSourceCodester Class and Exam Timetabling System preview6.php sql injectionEPSS 0.4%CVE-2026-19344MEDIUMcode-projects Task Management System comment_count_user.php sql injectionEPSS 0.4%CVE-2026-0592MEDIUMcode-projects Online Product Reservation System User Registration register_code.php sql injectionEPSS 0.4%CVE-2026-76050MEDIUMSourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injectionEPSS 0.4%CVE-2026-13521MEDIUMSourceCodester Class and Exam Timetabling System preview5.php sql injectionEPSS 0.4%CVE-2026-91004MEDIUMSourceCodester Online Faculty Clearance System delete_faculty1.php sql injectionEPSS 0.4%CVE-2026-7060MEDIUMliyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injectionEPSS 0.4%CVE-2026-85403MEDIUMcode-projects Doctor Appointment System contactus.php sql injectionEPSS 0.4%CVE-2026-86180MEDIUMcode-projects Task Management System In PHP Login index.php sql injectionEPSS 0.4%CVE-2026-90841MEDIUMPHPGurukul Blood Donor Management System Report Endpoint Report.php sql injectionEPSS 0.4%CVE-2026-16252MEDIUMBeijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injectionEPSS 0.4%CVE-2026-86222MEDIUMSourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injectionEPSS 0.4%