Fallos del tipo CWE-74

4853 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-10286MEDIUMCodeAstro Payroll System home_employee.php sql injectionEPSS 0.2%CVE-2026-11559MEDIUMCodeAstro Payroll System view_account.php sql injectionEPSS 0.2%CVE-2026-11584MEDIUMCodeAstro Student Attendance Management System createClass.php edit sql injectionEPSS 0.2%CVE-2026-105146MEDIUMComsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injectionEPSS 0.2%CVE-2026-101011MEDIUMaaPanel BaoTa Domain domainMod.py get_domain_status sql injectionEPSS 0.2%CVE-2026-101018MEDIUMdayrui XunruiCMS Group Editing Home.php group_all_edit sql injectionEPSS 0.2%CVE-2026-11480MEDIUMChengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injectionEPSS 0.2%CVE-2026-104052MEDIUMitsourcecode Pet Shop Management System admin_reject_completed.php sql injectionEPSS 0.2%CVE-2026-96777MEDIUMForma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionEPSS 0.2%CVE-2026-10257MEDIUMitsourcecode Content Management System update_ss_img.php sql injectionEPSS 0.2%CVE-2026-104053MEDIUMitsourcecode Pet Shop Management System admin_reservefilter.php sql injectionEPSS 0.2%CVE-2026-11585MEDIUMCodeAstro Student Attendance Management System createClassArms.php sql injectionEPSS 0.2%CVE-2026-11495MEDIUMCodeAstro Ingredients Stock Management System add_stock.php sql injectionEPSS 0.2%CVE-2026-104613MEDIUMCodeAstro Simple Pharmacy Management System view.php sql injectionEPSS 0.2%CVE-2026-10256MEDIUMitsourcecode Content Management System save_comment.php sql injectionEPSS 0.2%CVE-2026-10209MEDIUMcode-projects Online Hospital Management System Appointment appointmentdetail.php sql injectionEPSS 0.2%CVE-2026-10568MEDIUMitsourcecode Fees Management System manage_payment.php sql injectionEPSS 0.2%CVE-2026-105254MEDIUMitsourcecode Online Admission System schoolyear.php sql injectionEPSS 0.2%CVE-2026-10258MEDIUMitsourcecode Content Management System add_sub_topic.php sql injectionEPSS 0.2%CVE-2026-10302MEDIUMitsourcecode Fees Management System manage_fee.php sql injectionEPSS 0.2%