Fallos del tipo CWE-74

4755 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-2658MEDIUMPHPGurukul Online Security Guards Hiring System search-request.php sql injectionEPSS 0.5%CVE-2025-2675MEDIUMPHPGurukul Bank Locker Management System add-lockertype.php sql injectionEPSS 0.5%CVE-2025-2659MEDIUMProject Worlds Online Time Table Generator index.php sql injectionEPSS 0.5%CVE-2025-2683MEDIUMPHPGurukul Bank Locker Management System profile.php sql injectionEPSS 0.5%CVE-2026-15441MEDIUMProduct Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' ParameterEPSS 0.5%CVE-2025-2066MEDIUMprojectworlds Life Insurance Management System updateAgent.php sql injectionEPSS 0.5%CVE-2025-2677MEDIUMPHPGurukul Bank Locker Management System changeidproof.php sql injectionEPSS 0.5%CVE-2025-2640MEDIUMPHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-3143MEDIUMSourceCodester Apartment Visitor Management System visitor-entry.php sql injectionEPSS 0.5%CVE-2025-2644MEDIUMPHPGurukul Art Gallery Management System add-art-product.php sql injectionEPSS 0.5%CVE-2025-2646MEDIUMPHPGurukul Art Gallery Management System admin-profile.php sql injectionEPSS 0.5%CVE-2025-2034MEDIUMPHPGurukul Pre-School Enrollment System edit-class.php sql injectionEPSS 0.5%CVE-2025-2642MEDIUMPHPGurukul Art Gallery Management System edit-art-product-detail.php sql injectionEPSS 0.5%CVE-2025-2641MEDIUMPHPGurukul Art Gallery Management System edit-artist-detail.php sql injectionEPSS 0.5%CVE-2025-2674MEDIUMPHPGurukul Bank Locker Management System aboutus.php sql injectionEPSS 0.5%CVE-2025-2064MEDIUMprojectworlds Life Insurance Management System deletePayment.php sql injectionEPSS 0.5%CVE-2025-2643MEDIUMPHPGurukul Art Gallery Management System edit-art-type-detail.php sql injectionEPSS 0.5%CVE-2025-2050MEDIUMPHPGurukul User Registration & Login and User Management System login.php sql injectionEPSS 0.5%CVE-2025-2063MEDIUMprojectworlds Life Insurance Management System deleteNominee.php sql injectionEPSS 0.5%CVE-2025-2660MEDIUMProject Worlds Online Time Table Generator index.php sql injectionEPSS 0.5%