Fallos del tipo CWE-74

4804 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-2117MEDIUMBeijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System reportCenter.do electricDocList sql injectionEPSS 0.4%CVE-2025-11113MEDIUMCodeAstro Online Leave Application signup.php sql injectionEPSS 0.4%CVE-2025-12614MEDIUMSourceCodester Best House Rental Management System admin_class.php delete_payment sql injectionEPSS 0.4%CVE-2026-0729MEDIUMcode-projects Intern Membership Management System add_activity.php sql injectionEPSS 0.4%CVE-2025-2587MEDIUMJinher OA C6 IncentivePlanFulfillAppprove.aspx sql injectionEPSS 0.4%CVE-2025-7936MEDIUMfuyang_lipengjun platform ScheduleJobLogController.java queryPage sql injectionEPSS 0.4%CVE-2025-15182MEDIUMcode-projects Refugee Food Management System served.php sql injectionEPSS 0.4%CVE-2025-15184MEDIUMcode-projects Refugee Food Management System refugeesreport2.php sql injectionEPSS 0.4%CVE-2025-13811MEDIUMjsnjfz WebStack-Guns PageFactory.java sql injectionEPSS 0.4%CVE-2025-3163MEDIUMInternLM LMDeploy conf.py open code injectionEPSS 0.4%CVE-2025-10251MEDIUMFoxCMS Images.php batchCope sql injectionEPSS 0.4%CVE-2021-32622MEDIUMFile upload local preview can run embedded scripts after user interactionEPSS 0.4%CVE-2026-2469HIGHVersions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used EPSS 0.4%CVE-2024-40637MEDIUMImplicit override for built-in materializations from installed packages in dbt-coreEPSS 0.4%CVE-2026-49452MEDIUMWeasyPrint: CSS Injection via Presentational HintsEPSS 0.4%CVE-2025-13121MEDIUMcameasy Liketea API Endpoint StoreController.php list sql injectionEPSS 0.4%CVE-2025-8018MEDIUMcode-projects Food Ordering Review System reservation_page.php sql injectionEPSS 0.4%CVE-2025-7482MEDIUMPHPGurukul Vehicle Parking Management System print.php sql injectionEPSS 0.4%CVE-2025-6267MEDIUMzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 barcodeDetail sql injectionEPSS 0.4%CVE-2026-0852MEDIUMcode-projects Online Music Site AdminUpdateUser.php sql injectionEPSS 0.4%