Fallos del tipo CWE-74

4745 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-9662MEDIUMcode-projects Simple Grading System Admin Panel login.php sql injectionEPSS 0.6%CVE-2025-10802MEDIUMcode-projects Online Bidding System remove.php sql injectionEPSS 0.6%CVE-2025-10841MEDIUMcode-projects Online Bidding System weweee.php sql injectionEPSS 0.6%CVE-2025-9766MEDIUMitsourcecode Sports Management System facilitator.php sql injectionEPSS 0.6%CVE-2025-10801MEDIUMSourceCodester Pet Grooming Management Software edit_tax.php sql injectionEPSS 0.6%CVE-2025-3331MEDIUMcodeprojects Online Restaurant Management System payment_save.php sql injectionEPSS 0.6%CVE-2025-3308MEDIUMcode-projects Blood Bank Management System viewrequest.php sql injectionEPSS 0.6%CVE-2025-3330MEDIUMcodeprojects Online Restaurant Management System reservation_save.php sql injectionEPSS 0.6%CVE-2025-3332MEDIUMcodeprojects Online Restaurant Management System menu_save.php sql injectionEPSS 0.6%CVE-2026-3135MEDIUMitsourcecode News Portal Project add-category.php sql injectionEPSS 0.6%CVE-2026-2865MEDIUMitsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injectionEPSS 0.6%CVE-2026-2690MEDIUMitsourcecode Event Management System Admin Login ajax.php sql injectionEPSS 0.6%CVE-2026-3069MEDIUMitsourcecode Document Management System edtlbls.php sql injectionEPSS 0.6%CVE-2026-2691MEDIUMitsourcecode Event Management System manage_register.php sql injectionEPSS 0.6%CVE-2026-3042MEDIUMitsourcecode Event Management System index.php sql injectionEPSS 0.6%CVE-2026-3133MEDIUMitsourcecode Document Management System Login loging.php sql injectionEPSS 0.6%CVE-2026-2689MEDIUMitsourcecode Event Management System manage_booking.php sql injectionEPSS 0.6%CVE-2026-3046MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injectionEPSS 0.6%CVE-2026-2848MEDIUMSourceCodester Simple Responsive Tourism Website Registration Master.php sql injectionEPSS 0.6%CVE-2026-3068MEDIUMitsourcecode Document Management System deluser.php sql injectionEPSS 0.6%