Fallos del tipo CWE-74

4831 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-13548MEDIUMitsourcecode Hospital Management System doctortimings.php sql injectionEPSS 0.3%CVE-2026-14703MEDIUMitsourcecode Hospital Management System patientorder.php sql injectionEPSS 0.3%CVE-2026-78112MEDIUMitsourcecode Hospital Management System Project in PHP viewservicetype.php sql injectionEPSS 0.3%CVE-2026-82541MEDIUMitsourcecode Sales and Inventory System sup_edit.php sql injectionEPSS 0.3%CVE-2026-13525MEDIUMCodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injectionEPSS 0.3%CVE-2026-19923MEDIUMcode-projects Online Shopping System checkout_process.php sql injectionEPSS 0.3%CVE-2026-16244MEDIUMitsourcecode Hospital Management System prescriptionorderreport.php sql injectionEPSS 0.3%CVE-2026-86291MEDIUMitsourcecode Sales and Inventory System us_edit1.php sql injectionEPSS 0.3%CVE-2026-13497MEDIUMitsourcecode Hospital Management System appointment.php sql injectionEPSS 0.3%CVE-2026-14773MEDIUMitsourcecode Hospital Management System payment.php sql injectionEPSS 0.3%CVE-2026-76997MEDIUMSourceCodester Simple Online Food Ordering System ajax.php save_category sql injectionEPSS 0.3%CVE-2026-19921MEDIUMcode-projects Online Shopping System homeaction.php sql injectionEPSS 0.3%CVE-2026-14658MEDIUMcode-projects Assessment Management marking-scheme.php sql injectionEPSS 0.3%CVE-2026-14731MEDIUMitsourcecode Hospital Management System patientreport.php sql injectionEPSS 0.3%CVE-2026-86235MEDIUMitsourcecode Sales and Inventory System pos_transac.php add sql injectionEPSS 0.3%CVE-2026-16131MEDIUMitsourcecode Hospital Management System prescriptionrecord.php sql injectionEPSS 0.3%CVE-2026-19972MEDIUMitsourcecode Hospital Management System viewpatient.php sql injectionEPSS 0.3%CVE-2026-75876MEDIUMxianrendzw EasyReport Move Operations ModuleController.java sql injectionEPSS 0.3%CVE-2026-82540MEDIUMitsourcecode Sales and Inventory System cust_searchfrm.php sql injectionEPSS 0.3%CVE-2026-86267MEDIUMitsourcecode Information System Society Membership System check_student.php sql injectionEPSS 0.3%