Fallos del tipo CWE-74

4828 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2023-4843MEDIUMPega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however EPSS 0.3%CVE-2026-82424MEDIUMPHPGurukul Student Information System student_edit1.php sql injectionEPSS 0.3%CVE-2025-8702MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Historical Data Query Module GetVariableByOneIDNew sql injectionEPSS 0.3%CVE-2025-0214LOWTMD Custom Header Menu index.php sql injectionEPSS 0.3%CVE-2025-10110MEDIUMChanCMS search sql injectionEPSS 0.3%CVE-2025-9689MEDIUMSourceCodester Advanced School Management System item_select sql injectionEPSS 0.3%CVE-2025-8705MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module GetTargetConfig sql injectionEPSS 0.3%CVE-2025-8701MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System GetPageList sql injectionEPSS 0.3%CVE-2025-8703MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Environmental Real-Time Data Module GetAreaTrendChartData sql injectionEPSS 0.3%CVE-2025-8706MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module CreateFunctionLog sql injectionEPSS 0.3%CVE-2025-8704MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Analysis Conclusion Query Module GetAlarmResultProcessList sql injectionEPSS 0.3%CVE-2025-14227MEDIUMPhilipinho Simple-PHP-Blog edit.php sql injectionEPSS 0.3%CVE-2025-11038MEDIUMitsourcecode Online Clinic Management System details.php sql injectionEPSS 0.3%CVE-2025-8908MEDIUMShanghai Lingdang Information Technology Lingdang CRM event.php sql injectionEPSS 0.3%CVE-2025-13123MEDIUMAMTT Hotel Broadband Operation System get_firstdate.php sql injectionEPSS 0.3%CVE-2025-8276MEDIUMHTML Injection in Patika Global Technologies' HumanSuiteEPSS 0.3%CVE-2025-1836MEDIUMIncorta Edit Insight csv injectionEPSS 0.3%CVE-2023-44109—Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.3%CVE-2026-2162MEDIUMitsourcecode News Portal Project aboutus.php sql injectionEPSS 0.3%CVE-2025-46814LOWFastAPI Guard Remote Header Injection via X-Forwarded-For ManipulationEPSS 0.3%