Fallos del tipo CWE-74

4850 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-105247MEDIUMSourceCodester Online Reviewer Management System btn_functions.php course sql injectionEPSS 0.3%CVE-2026-105183MEDIUMitsourcecode Online Admission System confirm.php sql injectionEPSS 0.3%CVE-2026-95926MEDIUMSourceCodester Online Reviewer Management System btn_functions.php update sql injectionEPSS 0.3%CVE-2026-105185MEDIUMitsourcecode Online Admission System examinee.php sql injectionEPSS 0.3%CVE-2026-105230MEDIUMkishor-23 food-waste-management-system deliverymyord.php sql injectionEPSS 0.3%CVE-2026-105231MEDIUMkishor-23 food-waste-management-system Admin Registration signup.php sql injectionEPSS 0.3%CVE-2026-11472MEDIUMSourceCodester Class and Exam Timetabling System index1.php sql injectionEPSS 0.3%CVE-2026-11501MEDIUMSourceCodester Hospitals Patient Records Management System Master.php save_patient sql injectionEPSS 0.3%CVE-2026-10260MEDIUMCodeAstro Online Job Portal delete-jobs.php sql injectionEPSS 0.3%CVE-2026-105253MEDIUMitsourcecode Online Admission System Project login1.php sql injectionEPSS 0.3%CVE-2026-10261MEDIUMCodeAstro Online Job Portal application_status.php sql injectionEPSS 0.3%CVE-2026-10237MEDIUMSourceCodester Water Billing Management System User Management manage_user sql injectionEPSS 0.3%CVE-2026-103117MEDIUMOS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injectionEPSS 0.3%CVE-2026-11456MEDIUMChanjet CRM HTTP GET Request jxf_dump_systable.php sql injectionEPSS 0.3%CVE-2026-47162HIGHVim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory nameEPSS 0.3%CVE-2025-9802MEDIUMRemoteClinic profile.php sql injectionEPSS 0.3%CVE-2025-5373MEDIUMPHPGurukul Online Birth Certificate System users-applications.php sql injectionEPSS 0.3%CVE-2025-11628MEDIUMjimit105 Project-Online-Shopping-Website Product Inventory delete.php sql injectionEPSS 0.3%CVE-2024-6702MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.EPSS 0.3%CVE-2026-11435MEDIUMJinher OA nextselectplan.aspx sql injectionEPSS 0.3%