Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-3842MEDIUMpanhainan DS-Java FileUpload.java uploadUserPic.action code injectionEPSS 0.7%CVE-2022-34466—A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix EPSS 0.7%CVE-2024-10991MEDIUMCodezips Hospital Appointment System editBranchResult.php sql injectionEPSS 0.7%CVE-2024-10996MEDIUM1000 Projects Bookstore Management System process_category_edit.php sql injectionEPSS 0.7%CVE-2024-12229MEDIUMPHPGurukul Complaint Management System complaint-search.php sql injectionEPSS 0.7%CVE-2024-10998MEDIUM1000 Projects Bookstore Management System process_category_add.php sql injectionEPSS 0.7%CVE-2024-12231MEDIUMCodeZips Project Management System index.php sql injectionEPSS 0.7%CVE-2024-12230MEDIUMPHPGurukul Complaint Management System subcategory.php sql injectionEPSS 0.7%CVE-2024-10968MEDIUM1000 Projects Bookstore Management System contact_process.php sql injectionEPSS 0.7%CVE-2024-10995MEDIUMCodezips Hospital Appointment System removeDoctorResult.php sql injectionEPSS 0.7%CVE-2024-12188MEDIUM1000 Projects Library Management System stu.php sql injectionEPSS 0.7%CVE-2024-12228MEDIUMPHPGurukul Complaint Management System user-search.php sql injectionEPSS 0.7%CVE-2026-65646CRITICALImproper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arEPSS 0.7%CVE-2021-37499MEDIUMCRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function,EPSS 0.7%CVE-2023-0476MEDIUMA LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An autheEPSS 0.7%CVE-2024-11589MEDIUMitsourcecode Tailoring Management System expcatedit.php sql injectionEPSS 0.7%CVE-2021-21580MEDIUMDell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, wheEPSS 0.7%CVE-2025-0296MEDIUMcode-projects Online Book Shop booklist.php sql injectionEPSS 0.7%CVE-2025-3563MEDIUMWuzhiCMS Setting index.php set code injectionEPSS 0.7%CVE-2025-0207MEDIUMcode-projects Online Shoe Store login.php sql injectionEPSS 0.7%