Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-7173MEDIUMcode-projects Library System add-student.php sql injectionEPSS 0.6%CVE-2025-7933MEDIUMCampcodes Sales and Inventory System Setting settings_update.php sql injectionEPSS 0.6%CVE-2026-16759MEDIUMTutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST ParametersEPSS 0.6%CVE-2025-1812MEDIUMzj1983 zz SuperZ.java GetUserOrg sql injectionEPSS 0.6%CVE-2025-0210MEDIUMCampcodes School Faculty Scheduling System ajax.php sql injectionEPSS 0.6%CVE-2024-12969MEDIUMcode-projects Hospital Management System Login index.php sql injectionEPSS 0.6%CVE-2025-1850MEDIUMCodezips College Management System university.php sql injectionEPSS 0.6%CVE-2025-0533MEDIUM1000 Projects Campaign Management System Platform for Women sc_login.php sql injectionEPSS 0.6%CVE-2025-0842MEDIUMneedyamin Library Card System Login admin.php sql injectionEPSS 0.6%CVE-2025-0843MEDIUMneedyamin Library Card System Admin Panel admindashboard.php sql injectionEPSS 0.6%CVE-2025-1856MEDIUMCodezips Gym Management System gen_invoice.php sql injectionEPSS 0.6%CVE-2025-1858MEDIUMCodezips Online Shopping Website success.php sql injectionEPSS 0.6%CVE-2025-0534MEDIUM1000 Projects Campaign Management System Platform for Women loginnew.php sql injectionEPSS 0.6%CVE-2024-41122HIGHCustom environment variables allow to alter execution flow of plugins in WoodpeckerEPSS 0.6%CVE-2023-30609MEDIUMmatrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlightingEPSS 0.6%CVE-2024-20429MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attackeEPSS 0.6%CVE-2025-4866MEDIUMweibocom rill-flow Management Console code injectionEPSS 0.6%CVE-2024-27708CRITICALIframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary EPSS 0.6%CVE-2025-4782MEDIUMSourceCodester/oretnom23 Stock Management System view_receiving sql injectionEPSS 0.6%CVE-2024-12962MEDIUMcode-projects Job Recruitment _all_edits.php sql injectionEPSS 0.6%