Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-4490MEDIUMCampcodes Online Food Ordering System view-ticket-admin.php sql injectionEPSS 0.7%CVE-2026-5797MEDIUMQuiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input FieldsEPSS 0.7%CVE-2026-26002MEDIUMOnDemand susceptible to malicious input when navigating to a directory.EPSS 0.7%CVE-2022-4768MEDIUMDropbox merou SSH Public Key public_key.py add_public_key injectionEPSS 0.7%CVE-2024-10153MEDIUMPHPGurukul Boat Booking System Book a Boat Page book-boat.php sql injectionEPSS 0.7%CVE-2024-12940MEDIUM1000 Projects Attendance Tracking Management System student_action.php sql injectionEPSS 0.7%CVE-2024-5193MEDIUMRitlabs TinyWeb Server Request crlf injectionEPSS 0.7%CVE-2025-4332MEDIUMPHPGurukul Company Visitor Management System visitor-detail.php sql injectionEPSS 0.7%CVE-2023-4818HIGHPAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader sigEPSS 0.7%CVE-2025-5248MEDIUMPHPGurukul Company Visitor Management System bwdates-reports-details.php sql injectionEPSS 0.7%CVE-2025-0803MEDIUMCodezips Gym Management System submit_plan_new.php sql injectionEPSS 0.7%CVE-2025-4546MEDIUM1Panel-dev MaxKB Knowledge Base Module csv injectionEPSS 0.7%CVE-2023-29389MEDIUMToyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a EPSS 0.7%CVE-2025-3039MEDIUMcode-projects Payroll Management System add_employee.php sql injectionEPSS 0.7%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.7%CVE-2025-3038MEDIUMcode-projects Payroll Management System view_account.php sql injectionEPSS 0.7%CVE-2024-12976MEDIUMCodeZips Hospital Management System staff.php sql injectionEPSS 0.7%CVE-2024-12792MEDIUMCodezips E-Commerce Site newadmin.php sql injectionEPSS 0.7%CVE-2025-0297MEDIUMcode-projects Online Book Shop detail.php sql injectionEPSS 0.7%CVE-2024-11077MEDIUMcode-projects Job Recruitment index.php sql injectionEPSS 0.7%