Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-4785MEDIUMPHPGurukul Daily Expense Tracker System user-profile.php sql injectionEPSS 0.7%CVE-2026-93967MEDIUMaiyiyi121 SxDevOps Command services.py generate_host_task command injectionEPSS 0.7%CVE-2026-5584MEDIUMFosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injectionEPSS 0.7%CVE-2024-11244MEDIUMcode-projects Farmacia editar-cliente.php sql injectionEPSS 0.7%CVE-2025-4793MEDIUMPHPGurukul Online Course Registration edit-student-profile.php sql injectionEPSS 0.7%CVE-2023-7100MEDIUMPHPGurukul Restaurant Table Booking System bwdates-report-details.php sql injectionEPSS 0.7%CVE-2024-12492MEDIUMcode-projects Farmacia visualizar-usuario.php sql injectionEPSS 0.7%CVE-2024-11250MEDIUMcode-projects Inventory Management editProduct.php sql injectionEPSS 0.7%CVE-2026-6110MEDIUMFoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injectionEPSS 0.7%CVE-2026-5970MEDIUMFoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injectionEPSS 0.7%CVE-2024-13007MEDIUMCodezips Event Management System contact.php sql injectionEPSS 0.7%CVE-2024-12900MEDIUMFoxCMS Configuration File installdb.php code injectionEPSS 0.7%CVE-2026-71320HIGHNuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsEPSS 0.7%CVE-2025-0527MEDIUMcode-projects Admission Management System signupconfirm.php sql injectionEPSS 0.7%CVE-2024-11256MEDIUM1000 Projects Portfolio Management System MCA login.php sql injectionEPSS 0.7%CVE-2024-52004HIGHRemote code execution vulnerabilities in MediaCMSEPSS 0.7%CVE-2024-13006MEDIUM1000 Projects Human Resource Management System employeeview.php sql injectionEPSS 0.7%CVE-2024-41111HIGHBishopFox Sliver Authenticated Remote Code ExecutionEPSS 0.7%CVE-2022-46873HIGHBecause Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwEPSS 0.7%CVE-2025-0347MEDIUMcode-projects Admission Management System Login index.php sql injectionEPSS 0.7%