Fallos del tipo CWE-74

4788 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-77020MEDIUMCodeAstro Apartment Visitor Management System password-recovery.php sql injectionEPSS 0.4%CVE-2026-87921MEDIUMRizwan17 inventory-management-system manage.php update_record sql injectionEPSS 0.4%CVE-2026-78244MEDIUMitsourcecode Real Estate Management System search.php sql injectionEPSS 0.4%CVE-2026-79845MEDIUMcode-projects Simple Inventory System edit.php sql injectionEPSS 0.4%CVE-2026-13487MEDIUMSourceCodester Class and Exam Timetabling System archive.php sql injectionEPSS 0.4%CVE-2026-85187MEDIUMitsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injectionEPSS 0.4%CVE-2026-14713MEDIUMSourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injectionEPSS 0.4%CVE-2026-1589MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.4%CVE-2026-13526MEDIUMSourceCodester Class and Exam Timetabling System edit_class.php sql injectionEPSS 0.4%CVE-2026-14649MEDIUMcode-projects Online Voting System saveVote.php test_input sql injectionEPSS 0.4%CVE-2026-82613MEDIUMitsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injectionEPSS 0.4%CVE-2026-81203MEDIUMSourceCodester Simple Online Food Ordering System ajax.php login2 sql injectionEPSS 0.4%CVE-2026-76048MEDIUMSourceCodester Simple Online Food Ordering System ajax.php login sql injectionEPSS 0.4%CVE-2026-90516MEDIUMSourceCodester School Registration and Fee System pay_report.php sql injectionEPSS 0.4%CVE-2026-13565MEDIUMSourceCodester Class and Exam Timetabling System edit_class1.php sql injectionEPSS 0.4%CVE-2026-78248MEDIUMSourceCodester Simple Online Food Ordering System ajax.php save_settings sql injectionEPSS 0.4%CVE-2026-14733MEDIUMSourceCodester Class and Exam Timetabling System edit_coursea.php sql injectionEPSS 0.4%CVE-2026-76764MEDIUMcode-projects Employee Management System Admin Login Endpoint aprocess.php sql injectionEPSS 0.4%CVE-2026-90876MEDIUMSourceCodester Online Faculty Clearance System delete_requirement.php sql injectionEPSS 0.4%CVE-2026-14744MEDIUMcode-projects Real State Services normalHomeRent.php sql injectionEPSS 0.4%