Fallos del tipo CWE-74

4829 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-19920MEDIUMcode-projects Online Shopping System action.php sql injectionEPSS 0.3%CVE-2026-13525MEDIUMCodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injectionEPSS 0.3%CVE-2026-13496MEDIUMitsourcecode Hospital Management System ajaxmedicine.php sql injectionEPSS 0.3%CVE-2026-13578MEDIUMitsourcecode Hospital Management System patientdetail.php sql injectionEPSS 0.3%CVE-2026-5328MEDIUMshsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injectionEPSS 0.3%CVE-2026-19070MEDIUMitsourcecode Hospital Management System viewadmin.php sql injectionEPSS 0.3%CVE-2026-16490MEDIUMitsourcecode Hospital Management System prescription.php sql injectionEPSS 0.3%CVE-2026-82545MEDIUMitsourcecode Sales and Inventory System sup_searchfrm.php sql injectionEPSS 0.3%CVE-2026-5620MEDIUMitsourcecode Construction Management System Parameter borrowed_equip_report.php sql injectionEPSS 0.3%CVE-2026-19921MEDIUMcode-projects Online Shopping System homeaction.php sql injectionEPSS 0.3%CVE-2026-16131MEDIUMitsourcecode Hospital Management System prescriptionrecord.php sql injectionEPSS 0.3%CVE-2026-13497MEDIUMitsourcecode Hospital Management System appointment.php sql injectionEPSS 0.3%CVE-2026-86233MEDIUMitsourcecode Sales and Inventory System us_del.php sql injectionEPSS 0.3%CVE-2026-14658MEDIUMcode-projects Assessment Management marking-scheme.php sql injectionEPSS 0.3%CVE-2026-13579MEDIUMitsourcecode Hospital Management System patientchangepassword.php sql injectionEPSS 0.3%CVE-2026-16244MEDIUMitsourcecode Hospital Management System prescriptionorderreport.php sql injectionEPSS 0.3%CVE-2026-19067MEDIUMitsourcecode Hospital Management System treatment.php sql injectionEPSS 0.3%CVE-2026-14798MEDIUMCodeAstro Apartment Visitor Management System visitor-entry.php sql injectionEPSS 0.3%CVE-2026-15477MEDIUMBahmni bahmnicore Search Endpoint sql additionalParams sql injectionEPSS 0.3%CVE-2026-15523MEDIUMCodeAstro Simple Online Leave Management System dashboard.php sql injectionEPSS 0.3%