Fallos del tipo CWE-74

4745 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-3046MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injectionEPSS 0.6%CVE-2026-3134MEDIUMitsourcecode News Portal Project edit-category.php sql injectionEPSS 0.6%CVE-2025-1162MEDIUMcode-projects Job Recruitment load\_user-profile.php sql injectionEPSS 0.6%CVE-2026-4039MEDIUMOpenClaw Skill Env applySkillConfigenvOverrides code injectionEPSS 0.6%CVE-2025-2662MEDIUMProject Worlds Online Time Table Generator studentdashboard.php sql injectionEPSS 0.6%CVE-2025-41083MEDIUMImproper Neutralization in Altitude Communication ServerEPSS 0.6%CVE-2024-29896HIGHAstro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injectionsEPSS 0.6%CVE-2023-42135MEDIUMPAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection EPSS 0.6%CVE-2025-8499MEDIUMcode-projects Online Medicine Guide cusfindambulence2.php sql injectionEPSS 0.6%CVE-2024-13024MEDIUMCodezips Blood Bank Management System campaign.php sql injectionEPSS 0.6%CVE-2026-2912MEDIUMcode-projects Online Reviewer System studentresult-view.php sql injectionEPSS 0.6%CVE-2025-10673MEDIUMitsourcecode Student Information Management System index.php sql injectionEPSS 0.6%CVE-2025-10791MEDIUMcode-projects Online Bidding System index.php sql injectionEPSS 0.6%CVE-2025-10795MEDIUMcode-projects Online Bidding System bidupdate.php sql injectionEPSS 0.6%CVE-2025-7176MEDIUMPHPGurukul Hospital Management System view-medhistory.php sql injectionEPSS 0.6%CVE-2025-10793MEDIUMcode-projects E-Commerce Website admin_account_delete.php sql injectionEPSS 0.6%CVE-2026-3818MEDIUMTiandy Easy7 CMS Windows GetDBData.jsp sql injectionEPSS 0.6%CVE-2026-63621MEDIUMApache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategyEPSS 0.6%CVE-2025-1963MEDIUMprojectworlds Online Hotel Booking reservation.php sql injectionEPSS 0.6%CVE-2023-36250HIGHCSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file whenEPSS 0.6%