Fallos del tipo CWE-74

4746 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-4250MEDIUMcode-projects Nero Social Networking Site index.php sql injectionEPSS 0.6%CVE-2025-5214MEDIUMKashipara Responsive Online Learing Platform course_detail_user_new.php sql injectionEPSS 0.6%CVE-2025-11944MEDIUMgivanz Vvveb Raw SQL import.php import sql injectionEPSS 0.6%CVE-2025-4861MEDIUMPHPGurukul Beauty Parlour Management System admin-profile.php sql injectionEPSS 0.6%CVE-2025-4880MEDIUMPHPGurukul News Portal aboutus.php sql injectionEPSS 0.6%CVE-2025-5216MEDIUMPHPGurukul Student Record System login.php sql injectionEPSS 0.6%CVE-2025-5332MEDIUM1000 Projects Online Notice Board index.php sql injectionEPSS 0.6%CVE-2025-4874MEDIUMPHPGurukul News Portal Project contactus.php sql injectionEPSS 0.6%CVE-2025-5205MEDIUM1000 Projects Daily College Class Work Report Book dcwr_entry.php sql injectionEPSS 0.6%CVE-2025-4241MEDIUMPHPGurukul Teacher Subject Allocation Management System search.php sql injectionEPSS 0.6%CVE-2025-4226MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System add-computer.php sql injectionEPSS 0.6%CVE-2022-39217MEDIUMImproper Neutralization of Formula Elements in a CSV File in ghas-to-csvEPSS 0.6%CVE-2025-2378MEDIUMPHPGurukul Medical Card Generation System download-medical-cards.php sql injectionEPSS 0.6%CVE-2025-0490MEDIUMFanli2012 native-php-cms article_dodel.php sql injectionEPSS 0.6%CVE-2024-34697HIGHFreescout vulnerable to Stored HTML Injection in Editing Received EmailsEPSS 0.6%CVE-2024-12485MEDIUMcode-projects Online Class and Exam Scheduling System department.php sql injectionEPSS 0.6%CVE-2025-5400MEDIUMchaitak-gorai Blogbook GET Parameter user.php sql injectionEPSS 0.6%CVE-2024-12488MEDIUMcode-projects Online Class and Exam Scheduling System subject_update.php sql injectionEPSS 0.6%CVE-2024-12489MEDIUMcode-projects Online Class and Exam Scheduling System term.php sql injectionEPSS 0.6%CVE-2024-12487MEDIUMcode-projects Online Class and Exam Scheduling System room_update.php sql injectionEPSS 0.6%