Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2024-11965MEDIUMPHPGurukul Complaint Management system reset-password.php sql injectionEPSS 0.9%CVE-2023-51446MEDIUMGLPI LDAP Injection during authenticationEPSS 0.9%CVE-2024-12497MEDIUM1000 Projects Attendance Tracking Management System check_admin_login.php sql injectionEPSS 0.9%CVE-2022-35735HIGHBIG-IP monitor configuration vulnerability CVE-2022-35735EPSS 0.9%CVE-2026-41109HIGHGitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2024-11956MEDIUMPimcore customer-data-framework list sql injectionEPSS 0.9%CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2023-45303HIGHThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supEPSS 0.9%CVE-2024-34919CRITICALAn arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 alEPSS 0.9%CVE-2024-11649MEDIUM1000 Projects Beauty Parlour Management System search-appointment.php sql injectionEPSS 0.9%CVE-2024-11590MEDIUM1000 Projects Bookstore Management System forget_password_process.php sql injectionEPSS 0.9%CVE-2024-11648MEDIUM1000 Projects Beauty Parlour Management System add-customer.php sql injectionEPSS 0.9%CVE-2024-11647MEDIUM1000 Projects Beauty Parlour Management System view-appointment.php sql injectionEPSS 0.9%CVE-2023-26261CRITICALIn UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another conneEPSS 0.8%CVE-2025-4458MEDIUMcode-projects Patient Record Management System edit_upatient.php sql injectionEPSS 0.8%CVE-2025-4459MEDIUMcode-projects Patient Record Management System fecalysis_form.php sql injectionEPSS 0.8%CVE-2020-26260MEDIUMServer Side Request Forgery in BookStackEPSS 0.8%CVE-2025-5579MEDIUMPHPGurukul Dairy Farm Shop Management System search-product.php sql injectionEPSS 0.8%CVE-2021-29502HIGHRemote code execution in the WarnSystem module of Laggrons-Dumb-CogsEPSS 0.8%CVE-2024-23648HIGHPimcore Admin Classic Bundle host header injection in the password resetEPSS 0.8%