Fallos del tipo CWE-74

4853 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-105187MEDIUMitsourcecode Online Admission System key.php sql injectionEPSS 0.2%CVE-2026-11510MEDIUMCodeAstro Leave Management System add_leave.php sql injectionEPSS 0.2%CVE-2026-10808MEDIUMitsourcecode Fees Management System manage_student.php sql injectionEPSS 0.2%CVE-2026-10257MEDIUMitsourcecode Content Management System update_ss_img.php sql injectionEPSS 0.2%CVE-2026-96777MEDIUMForma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionEPSS 0.2%CVE-2026-104614MEDIUMCodeAstro Simple Pharmacy Management System delete.php sql injectionEPSS 0.2%CVE-2026-11585MEDIUMCodeAstro Student Attendance Management System createClassArms.php sql injectionEPSS 0.2%CVE-2026-104052MEDIUMitsourcecode Pet Shop Management System admin_reject_completed.php sql injectionEPSS 0.2%CVE-2026-95833MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.2%CVE-2026-11480MEDIUMChengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injectionEPSS 0.2%CVE-2026-105181MEDIUMitsourcecode Online Admission System register1.php sql injectionEPSS 0.2%CVE-2026-10809MEDIUMitsourcecode Fees Management System manage_user.php sql injectionEPSS 0.2%CVE-2026-10297MEDIUMitsourcecode Fees Management System manage_course.php sql injectionEPSS 0.2%CVE-2026-11514MEDIUMitsourcecode Hospital Management System addpatient.php sql injectionEPSS 0.2%CVE-2026-105168MEDIUMkishor-23 food-waste-management-system Order Assignment Block admin.php sql injectionEPSS 0.2%CVE-2026-104625MEDIUMCodeAstro Simple Loan Management System index.php sql injectionEPSS 0.2%CVE-2026-104613MEDIUMCodeAstro Simple Pharmacy Management System view.php sql injectionEPSS 0.2%CVE-2026-10256MEDIUMitsourcecode Content Management System save_comment.php sql injectionEPSS 0.2%CVE-2026-11513MEDIUMitsourcecode Hospital Management System adminaccount.php sql injectionEPSS 0.2%CVE-2026-11508MEDIUMCodeAstro Leave Management System search_staff_to_assign_pc.php sql injectionEPSS 0.2%