Fallos del tipo CWE-74

4791 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-2171MEDIUMcode-projects Online Student Management System Login accounts.php sql injectionEPSS 0.4%CVE-2025-13298MEDIUMitsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionEPSS 0.4%CVE-2025-7540MEDIUMcode-projects Online Appointment Booking System getclinic.php sql injectionEPSS 0.4%CVE-2025-7610MEDIUMcode-projects Electricity Billing System change_password.php sql injectionEPSS 0.4%CVE-2025-7454MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_theater.php sql injectionEPSS 0.4%CVE-2025-9701MEDIUMSourceCodester Simple Cafe Billing System receipt.php sql injectionEPSS 0.4%CVE-2025-13285MEDIUMitsourcecode Online Voting System login.php sql injectionEPSS 0.4%CVE-2025-7456MEDIUMCampcodes Online Movie Theater Seat Reservation System reserve.php sql injectionEPSS 0.4%CVE-2025-9679MEDIUMitsourcecode Student Information System course_edit1.php sql injectionEPSS 0.4%CVE-2025-14514MEDIUMCampcodes Supplier Management System add_distributor.php sql injectionEPSS 0.4%CVE-2025-11614MEDIUMSourceCodester Best Salon Management System edit-appointment.php sql injectionEPSS 0.4%CVE-2025-7436MEDIUMCampcodes Online Recruitment Management System ajax.php sql injectionEPSS 0.4%CVE-2025-7608MEDIUMcode-projects Simple Shopping Cart userlogin.php sql injectionEPSS 0.4%CVE-2025-9730MEDIUMitsourcecode Apartment Management System updateProfile.php sql injectionEPSS 0.4%CVE-2025-9702MEDIUMSourceCodester Simple Cafe Billing System sales_report.php sql injectionEPSS 0.4%CVE-2025-9750MEDIUMCampcodes Online Learning Management System login.php sql injectionEPSS 0.4%CVE-2025-10402MEDIUMPHPGurukul Beauty Parlour Management System readenq.php sql injectionEPSS 0.4%CVE-2025-7483MEDIUMPHPGurukul Vehicle Parking Management System forgot-password.php sql injectionEPSS 0.4%CVE-2025-14623MEDIUMcode-projects Student File Management System update_student.php sql injectionEPSS 0.4%CVE-2025-8372MEDIUMcode-projects Exam Form Submission update_s7.php sql injectionEPSS 0.4%