Fallos del tipo CWE-74

4766 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-2088MEDIUMPHPGurukul Pre-School Enrollment System profile.php sql injectionEPSS 0.5%CVE-2025-1227MEDIUMywoa AddressDao.xml selectList sql injectionEPSS 0.5%CVE-2026-19351MEDIUMdresende node-sql-query Request Parameter Select.js SelectQuery.build sql injectionEPSS 0.5%CVE-2025-3968MEDIUMcodeprojects News Publishing Site Dashboard api.php sql injectionEPSS 0.5%CVE-2025-3796MEDIUMPHPGurukul Men Salon Management System contact-us.php sql injectionEPSS 0.5%CVE-2025-2033MEDIUMcode-projects Blood Bank Management System view_donor.php sql injectionEPSS 0.5%CVE-2026-20231CRITICALCisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements VulnerabilitiesEPSS 0.5%CVE-2025-3817MEDIUMSourceCodester Online Eyewear Shop Master.php sql injectionEPSS 0.5%CVE-2025-4060MEDIUMPHPGurukul Notice Board System category.php sql injectionEPSS 0.5%CVE-2025-3685MEDIUMcode-projects Patient Record Management System edit_fpatient.php sql injectionEPSS 0.5%CVE-2025-9660MEDIUMSourceCodester Bakeshop Online Ordering System passwordrecover.php sql injectionEPSS 0.5%CVE-2025-3134MEDIUMcode-projects Payroll Management System add_overtime.php sql injectionEPSS 0.5%CVE-2025-4197MEDIUMcode-projects Patient Record Management System edit_xpatient.php sql injectionEPSS 0.5%CVE-2025-3347MEDIUMcode-projects Patient Record Management System dental_pending.php sql injectionEPSS 0.5%CVE-2024-11101MEDIUM1000 Projects Beauty Parlour Management System search-invoices.php sql injectionEPSS 0.5%CVE-2025-3142MEDIUMSourceCodester Apartment Visitor Management System add-apartment.php sql injectionEPSS 0.5%CVE-2025-3696MEDIUMSourceCodester Web-based Pharmacy Product Management System search_stock. php sql injectionEPSS 0.5%CVE-2025-10482MEDIUMSourceCodester Online Student File Management System index.php sql injectionEPSS 0.5%CVE-2025-9470MEDIUMitsourcecode Apartment Management System add_m_committee.php sql injectionEPSS 0.5%CVE-2025-3697MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-product.php sql injectionEPSS 0.5%