Fallos del tipo CWE-74

4853 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-11606MEDIUMiPynch Social Network Website Search sql injectionEPSS 0.2%CVE-2026-105226MEDIUMosCommerce osCommerce2 Newsletter Management newsletters.php include code injectionEPSS 0.2%CVE-2026-10248MEDIUMSourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injectionEPSS 0.2%CVE-2026-10661MEDIUMahujasid blender-mcp server.py open injectionEPSS 0.2%CVE-2025-43267MEDIUMAn injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. An app may be able to access sensitiveEPSS 0.2%CVE-2025-7798MEDIUMBeijing Shenzhou Shihan Technology Multimedia Integrated Business Display System companyManage sql injectionEPSS 0.2%CVE-2025-10399MEDIUMKorzh EasyQuery Query Builder UI fetch sql injectionEPSS 0.2%CVE-2026-10170MEDIUMcode-projects Visitor Management System phone_0.php sql injectionEPSS 0.2%CVE-2026-81571MEDIUMBrave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM ParameterEPSS 0.2%CVE-2026-78363MEDIUMMW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge TagsEPSS 0.2%CVE-2026-80439MEDIUMRedirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-TagsEPSS 0.2%CVE-2026-80437MEDIUMNinja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge TagsEPSS 0.2%CVE-2026-80440MEDIUMHustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message PlaceholdersEPSS 0.2%CVE-2026-15256MEDIUMNinja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field DefaultEPSS 0.2%CVE-2026-97225MEDIUMDbGate JSON Runner runners.js code injectionEPSS 0.2%CVE-2026-95868MEDIUMAdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injectionEPSS 0.2%CVE-2026-10175MEDIUMAider-AI Aider Architect Mode auth.py editor_coder.run code injectionEPSS 0.2%CVE-2025-14694MEDIUMketr JEPaaS readAllPostil sql injectionEPSS 0.2%CVE-2023-7331MEDIUMPKrystian Full-Stack-Bank User sql injectionEPSS 0.2%CVE-2025-13208MEDIUMFantasticLBP Hotels Server hotelList.php sql injectionEPSS 0.2%