Fallos del tipo CWE-74

4853 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-3026MEDIUMImproper Neutralization of Special Elements vulnerability in EJBCAEPSS 0.2%CVE-2026-10223MEDIUMNousResearch hermes-agent memory_tool.py _scan_memory_content injectionEPSS 0.2%CVE-2025-11279MEDIUMAxosoft Scrum and Bug Tracking Add Work Item csv injectionEPSS 0.2%CVE-2026-0843MEDIUMjiujiujia/victor123/wxw850227 jjjfood/jjjshop_food index sql injectionEPSS 0.2%CVE-2026-84740MEDIUMThe Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterEPSS 0.2%CVE-2026-101145MEDIUMEleveo Call Recording Software User Management userAddAction.do ldap injectionEPSS 0.2%CVE-2025-6785MEDIUMTesla Model 3 Physical CAN Bus InjectionEPSS 0.2%CVE-2025-4767MEDIUMdefog-ai introspect Test Endpoint integration_routes.py test_custom_tool code injectionEPSS 0.2%CVE-2026-44455MEDIUMHono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML InjectionEPSS 0.2%CVE-2026-18875HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-12175MEDIUMCodeAstro Student Attendance Management System createStudents.php sql injectionEPSS 0.2%CVE-2026-102912MEDIUMSourceCodester Online Leave Management System page reports sql injectionEPSS 0.2%CVE-2022-42544HIGHIn getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input valiEPSS 0.2%CVE-2025-66025MEDIUMCaido Improperly Handles External Links in MarkdownEPSS 0.2%CVE-2026-8795HIGHA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostnamEPSS 0.2%CVE-2026-11558MEDIUMCodeAstro Payroll System home_salary.php sql injectionEPSS 0.2%CVE-2026-24764LOWOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel DescriptionsEPSS 0.2%CVE-2026-10155MEDIUMBdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injectionEPSS 0.2%CVE-2026-10171MEDIUMcode-projects Online Music Site AdminUpdateAlbum.php sql injectionEPSS 0.2%CVE-2026-11529MEDIUMdesigncomputer mysql-mcp-server mysql URI server.py read_resource sql injectionEPSS 0.2%