Fallos del tipo CWE-74

4843 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-13273MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2025-13570MEDIUMitsourcecode COVID Tracking System page sql injectionEPSS 0.3%CVE-2025-13325MEDIUMitsourcecode Student Information System enrollment_edit1.php sql injectionEPSS 0.3%CVE-2025-13270MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2025-13571MEDIUMcode-projects Simple Food Ordering System listorder.php sql injectionEPSS 0.3%CVE-2025-13581MEDIUMitsourcecode Student Information System schedule_edit1.php sql injectionEPSS 0.3%CVE-2025-12926MEDIUMSourceCodester Farm Management System review.php sql injectionEPSS 0.3%CVE-2025-13286MEDIUMitsourcecode Online Voting System ajax.php sql injectionEPSS 0.3%CVE-2025-13290MEDIUMcode-projects Simple Food Ordering System saveorder.php sql injectionEPSS 0.3%CVE-2025-13569MEDIUMitsourcecode COVID Tracking System page sql injectionEPSS 0.3%CVE-2025-13568MEDIUMitsourcecode COVID Tracking System page sql injectionEPSS 0.3%CVE-2025-13274MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2026-10608MEDIUMDedeCMS carbuyaction.php RemoveXSS sql injectionEPSS 0.3%CVE-2025-14230MEDIUMcode-projects Daily Time Recording System add_payroll.php sql injectionEPSS 0.3%CVE-2024-46452MEDIUMA Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to rEPSS 0.3%CVE-2025-13579MEDIUMcode-projects Library System return.php sql injectionEPSS 0.3%CVE-2026-85117MEDIUMContact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationEPSS 0.3%CVE-2026-85113MEDIUMGiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor NameEPSS 0.3%CVE-2026-19848MEDIUMProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display NameEPSS 0.3%CVE-2025-13346MEDIUMSourceCodester Train Station Ticketing System ajax.php sql injectionEPSS 0.3%