Fallos del tipo CWE-74

4850 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-105230MEDIUMkishor-23 food-waste-management-system deliverymyord.php sql injectionEPSS 0.3%CVE-2026-105169MEDIUMkishor-23 food-waste-management-system Take Order delivery.php sql injectionEPSS 0.3%CVE-2026-10252MEDIUMitsourcecode Online House Rental System manage_tenant.php sql injectionEPSS 0.3%CVE-2026-95924MEDIUMSourceCodester Online Reviewer Management System btn_functions.php add sql injectionEPSS 0.3%CVE-2026-10225MEDIUMraisulislamg4 student_management_system_by_php Login login_check.php sql injectionEPSS 0.3%CVE-2026-11472MEDIUMSourceCodester Class and Exam Timetabling System index1.php sql injectionEPSS 0.3%CVE-2026-105253MEDIUMitsourcecode Online Admission System Project login1.php sql injectionEPSS 0.3%CVE-2026-105185MEDIUMitsourcecode Online Admission System examinee.php sql injectionEPSS 0.3%CVE-2026-11501MEDIUMSourceCodester Hospitals Patient Records Management System Master.php save_patient sql injectionEPSS 0.3%CVE-2026-105247MEDIUMSourceCodester Online Reviewer Management System btn_functions.php course sql injectionEPSS 0.3%CVE-2026-105183MEDIUMitsourcecode Online Admission System confirm.php sql injectionEPSS 0.3%CVE-2026-18085MEDIUMImproper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEMEPSS 0.3%CVE-2026-102909MEDIUMSourceCodester Online Reviewer Management System btn_functions.php sql injectionEPSS 0.3%CVE-2026-105172MEDIUMitsourcecode Online Admission System login1.php sql injectionEPSS 0.3%CVE-2026-10208MEDIUMcode-projects Online Hospital Management System login_1.php login_user sql injectionEPSS 0.3%CVE-2026-105232MEDIUMkishor-23 food-waste-management-system Registration deliverysignup.php sql injectionEPSS 0.3%CVE-2026-11471MEDIUMSourceCodester Class and Exam Timetabling System index2.php sql injectionEPSS 0.3%CVE-2026-105184MEDIUMitsourcecode Online Admission System creteria.php sql injectionEPSS 0.3%CVE-2026-10250MEDIUMitsourcecode Online Blood Bank Management System campsdetails.php sql injectionEPSS 0.3%CVE-2026-105231MEDIUMkishor-23 food-waste-management-system Admin Registration signup.php sql injectionEPSS 0.3%