Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2024-10967MEDIUMcode-projects E-Health Care System delete_user_appointment_request.php sql injectionEPSS 0.8%CVE-2026-54159CRITICALps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCEEPSS 0.8%CVE-2023-3694MEDIUMSourceCodester/projectworlds House Rental and Property Listing index.php sql injectionEPSS 0.8%CVE-2024-12960MEDIUM1000 Projects Portfolio Management System MCA update_edu_details.php sql injectionEPSS 0.7%CVE-2024-12959MEDIUM1000 Projects Portfolio Management System MCA update_personal_details.php sql injectionEPSS 0.7%CVE-2025-0564MEDIUMcode-projects Fantasy-Cricket authenticate.php sql injectionEPSS 0.7%CVE-2024-12958MEDIUM1000 Projects Portfolio Management System MCA update_pro_details.php sql injectionEPSS 0.7%CVE-2024-13004MEDIUMPHPGurukul Complaint Management System category.php sql injectionEPSS 0.7%CVE-2024-11257MEDIUM1000 Projects Beauty Parlour Management System forgot-password.php sql injectionEPSS 0.7%CVE-2024-11967MEDIUMPHPGurukul Complaint Management system reset-password.php sql injectionEPSS 0.7%CVE-2024-11744MEDIUM1000 Projects Portfolio Management System MCA register.php sql injectionEPSS 0.7%CVE-2024-47764MEDIUMcookie accepts cookie name, path, and domain with out of bounds charactersEPSS 0.7%CVE-2026-34041HIGHact: Unrestricted set-env and add-path command processing enables environment injectionEPSS 0.7%CVE-2022-3962MEDIUMKiali: error message spoofing in kiali uiEPSS 0.7%CVE-2025-24962HIGHCommand Injection in reNgineEPSS 0.7%CVE-2024-41121HIGHCustom workspace allow to overwrite plugin entrypoint executable in WoodpeckerEPSS 0.7%CVE-2024-6469MEDIUMplaySMS Template injectionEPSS 0.7%CVE-2025-3689MEDIUMPHPGurukul Men Salon Management System edit-customer-detailed.php sql injectionEPSS 0.7%CVE-2026-4963MEDIUMhuggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injectionEPSS 0.7%CVE-2024-34448HIGHGhost before 5.82.0 allows CSV Injection during a member CSV export.EPSS 0.7%