Fallos del tipo CWE-74

4811 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-7479MEDIUMPHPGurukul Vehicle Parking Management System view--detail.php sql injectionEPSS 0.4%CVE-2025-7162MEDIUMPHPGurukul Zoo Management System add-foreigners-ticket.php sql injectionEPSS 0.4%CVE-2025-7580MEDIUMcode-projects Voting System positions_row.php sql injectionEPSS 0.4%CVE-2025-7582MEDIUMPHPGurukul Online Fire Reporting System assigned-requests.php sql injectionEPSS 0.4%CVE-2025-7584MEDIUMPHPGurukul Online Fire Reporting System add-team.php sql injectionEPSS 0.4%CVE-2023-35075LOWHTML injection via channel autocompleteEPSS 0.4%CVE-2025-13168MEDIUMury-erp ury pos_extend.py overrided_past_order_list sql injectionEPSS 0.4%CVE-2025-15212MEDIUMcode-projects Refugee Food Management System regfood.php sql injectionEPSS 0.4%CVE-2026-13529MEDIUMYzmCMS index.php sql injectionEPSS 0.4%CVE-2026-16747MEDIUMKirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email ActionsEPSS 0.4%CVE-2025-13267MEDIUMSourceCodester Dental Clinic Appointment Reservation System success.php sql injectionEPSS 0.4%CVE-2025-2625MEDIUMwestboy CicadasCMS page sql injectionEPSS 0.4%CVE-2026-0584MEDIUMcode-projects Online Product Reservation System left_cart.php sql injectionEPSS 0.4%CVE-2026-0590MEDIUMcode-projects Online Product Reservation System POST Parameter delete.php sql injectionEPSS 0.4%CVE-2025-15211MEDIUMcode-projects Refugee Food Management System refugee.php sql injectionEPSS 0.4%CVE-2025-15210MEDIUMcode-projects Refugee Food Management System editrefugee.php sql injectionEPSS 0.4%CVE-2025-15209MEDIUMcode-projects Refugee Food Management System editfood.php sql injectionEPSS 0.4%CVE-2026-0591MEDIUMcode-projects Online Product Reservation System Cart Update update.php sql injectionEPSS 0.4%CVE-2025-13303MEDIUMcode-projects Courier Management System search-edit.php sql injectionEPSS 0.4%CVE-2026-76993LOWGreyDGL PentestGPT Web-Page Crawling injectionEPSS 0.4%