Fallos del tipo CWE-74

4802 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2023-50093MEDIUMAPIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection.EPSS 0.4%CVE-2025-8230MEDIUMCampcodes Courier Management System manage_user.php sql injectionEPSS 0.4%CVE-2025-15165MEDIUMitsourcecode Online Cake Ordering System updatecustomer.php sql injectionEPSS 0.4%CVE-2025-12607MEDIUMitsourcecode Online Loan Management System manage_payment.php sql injectionEPSS 0.4%CVE-2025-1192MEDIUMSourceCodester Multi Restaurant Table Reservation System select-menu.php sql injectionEPSS 0.4%CVE-2025-14989MEDIUMCampcodes Complete Online Beauty Parlor Management System search-invoices.php sql injectionEPSS 0.4%CVE-2025-15166MEDIUMitsourcecode Online Cake Ordering System updatesupplier.php sql injectionEPSS 0.4%CVE-2026-29777MEDIUMTraefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match valuesEPSS 0.4%CVE-2026-1176MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.4%CVE-2026-1688MEDIUMitsourcecode Directory Management System index.php sql injectionEPSS 0.4%CVE-2026-1546MEDIUMjishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injectionEPSS 0.4%CVE-2026-1595MEDIUMitsourcecode Society Management System edit_student_query.php sql injectionEPSS 0.4%CVE-2025-8186MEDIUMCampcodes Courier Management System edit_branch.php sql injectionEPSS 0.4%CVE-2024-1619MEDIUMKaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially fEPSS 0.4%CVE-2025-14990MEDIUMCampcodes Complete Online Beauty Parlor Management System view-appointment.php sql injectionEPSS 0.4%CVE-2026-1160MEDIUMPHPGurukul Directory Management System Search index.php sql injectionEPSS 0.4%CVE-2025-15167MEDIUMitsourcecode Online Cake Ordering System detailtransac.php sql injectionEPSS 0.4%CVE-2026-1552MEDIUMSEMCMS SEMCMS_Info.php sql injectionEPSS 0.4%CVE-2025-10218MEDIUMlostvip-com ruoyi-go Background Management SysRoleDao.go SelectListPage sql injectionEPSS 0.4%CVE-2025-10012MEDIUMPortabilis i-Educar educar_historico_escolar_lst.php sql injectionEPSS 0.4%