Fallos del tipo CWE-74

4806 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-1807MEDIUMEastnets PaymentSafe Edit Manual Reply directRouter.rfc cross site scriptingEPSS 0.4%CVE-2025-7482MEDIUMPHPGurukul Vehicle Parking Management System print.php sql injectionEPSS 0.4%CVE-2025-13485MEDIUMitsourcecode Online File Management System ajax.php sql injectionEPSS 0.4%CVE-2026-4571MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injectionEPSS 0.4%CVE-2026-4569MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injectionEPSS 0.4%CVE-2026-4572MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injectionEPSS 0.4%CVE-2025-7522MEDIUMPHPGurukul Vehicle Parking Management System bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2026-4825MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injectionEPSS 0.4%CVE-2026-4778MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injectionEPSS 0.4%CVE-2026-4777MEDIUMSourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injectionEPSS 0.4%CVE-2025-7520MEDIUMPHPGurukul Vehicle Parking Management System manage-category.php sql injectionEPSS 0.4%CVE-2025-7161MEDIUMPHPGurukul Zoo Management System add-normal-ticket.php sql injectionEPSS 0.4%CVE-2025-7167MEDIUMcode-projects Responsive Blog Site category.php sql injectionEPSS 0.4%CVE-2025-7484MEDIUMPHPGurukul Vehicle Parking Management System view-outgoingvehicle-detail.php sql injectionEPSS 0.4%CVE-2025-7163MEDIUMPHPGurukul Zoo Management System add-animals.php sql injectionEPSS 0.4%CVE-2025-7481MEDIUMPHPGurukul Vehicle Parking Management System profile.php sql injectionEPSS 0.4%CVE-2025-7166MEDIUMcode-projects Responsive Blog Site single.php sql injectionEPSS 0.4%CVE-2025-7162MEDIUMPHPGurukul Zoo Management System add-foreigners-ticket.php sql injectionEPSS 0.4%CVE-2025-7212MEDIUMitsourcecode Insurance Management System insertAgent.php sql injectionEPSS 0.4%CVE-2025-7159MEDIUMPHPGurukul Zoo Management System manage-animals.php sql injectionEPSS 0.4%