Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-27787HIGHApplio allows a DoS in restart.pyEPSS 0.8%CVE-2024-7219MEDIUMSourceCodester/Campcodes School Log Management System ajax.php sql injectionEPSS 0.8%CVE-2025-3690MEDIUMPHPGurukul Men Salon Management System edit-services.php sql injectionEPSS 0.8%CVE-2024-11646MEDIUM1000 Projects Beauty Parlour Management System edit-services.php sql injectionEPSS 0.8%CVE-2024-12884MEDIUMCodezips E-Commerce Website login.php sql injectionEPSS 0.8%CVE-2026-54680CRITICALLogging operator has Fluentd configuration injection that allows remote code executionEPSS 0.8%CVE-2015-10040MEDIUMgitlearn Escape Sequence config.sh getOutOf injectionEPSS 0.8%CVE-2026-33202MEDIUMRails Active Storage has possible glob injection in its DiskServiceEPSS 0.8%CVE-2026-76221HIGHGitPython before 3.1.58 Config Injection via option-nameEPSS 0.8%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.8%CVE-2024-3767MEDIUMPHPGurukul News Portal edit-post.php sql injectionEPSS 0.8%CVE-2026-45344HIGHLinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instancesEPSS 0.8%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2024-12490MEDIUMcode-projects Online Class and Exam Scheduling System teacher_save.php sql injectionEPSS 0.8%CVE-2023-1061MEDIUMSourceCodester Doctors Appointment System edit-doc.php sql injectionEPSS 0.8%CVE-2023-1059MEDIUMSourceCodester Doctors Appointment System Parameter doctors.php sql injectionEPSS 0.8%CVE-2024-13038MEDIUMCodeAstro Simple Loan Management System Login index.php sql injectionEPSS 0.8%CVE-2025-2217MEDIUMzzskzy Warehouse Refinement Management System getAdyData.ashx ProcessRequest sql injectionEPSS 0.8%CVE-2024-49381HIGHPlenti arbitrary file deletion vulnerabilityEPSS 0.8%CVE-2022-47052MEDIUMThe web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perfoEPSS 0.8%