Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-4464MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.9%CVE-2025-4456MEDIUMProject Worlds Car Rental Project signup.php sql injectionEPSS 0.9%CVE-2025-4466MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.9%CVE-2025-4457MEDIUMProject Worlds Car Rental Project approve.php sql injectionEPSS 0.9%CVE-2022-31108MEDIUMArbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.jsEPSS 0.9%CVE-2024-11592MEDIUM1000 Projects Beauty Parlour Management System about-us.php sql injectionEPSS 0.9%CVE-2026-29186HIGH@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code ExecutionEPSS 0.9%CVE-2026-87909HIGHWP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument InjectionEPSS 0.9%CVE-2024-11962MEDIUMcode-projects Simple Car Rental System login.php sql injectionEPSS 0.9%CVE-2024-1833MEDIUMSourceCodester Employee Management System login.php sql injectionEPSS 0.9%CVE-2025-0298MEDIUMcode-projects Online Book Shop process_login.php sql injectionEPSS 0.9%CVE-2015-10062MEDIUMgalaxy-data-resource Command Line Template injectionEPSS 0.9%CVE-2021-29501HIGHRemote code execution in ticketerEPSS 0.9%CVE-2024-11663MEDIUMCodezips E-Commerce Site search.php sql injectionEPSS 0.9%CVE-2020-15185LOWDuplicated chart entries in HelmEPSS 0.9%CVE-2026-65669CRITICALMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2025-67486HIGHDolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafieldsEPSS 0.9%CVE-2024-41127HIGHMonkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.EPSS 0.9%CVE-2024-11965MEDIUMPHPGurukul Complaint Management system reset-password.php sql injectionEPSS 0.9%CVE-2024-11966MEDIUMPHPGurukul Complaint Management system index.php sql injectionEPSS 0.9%