Fallos del tipo CWE-74

4769 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-3172MEDIUMProject Worlds Online Lawyer Management System lawyer_booking.php sql injectionEPSS 0.5%CVE-2025-2037MEDIUMcode-projects Blood Bank Management System delete_requester.php sql injectionEPSS 0.5%CVE-2025-3176MEDIUMProject Worlds Online Lawyer Management System single_lawyer.php sql injectionEPSS 0.5%CVE-2025-3847MEDIUMmarkparticle WebServer Login httprequest.cpp sql injectionEPSS 0.5%CVE-2025-5057MEDIUMCampcodes Online Shopping Portal insert-product.php sql injectionEPSS 0.5%CVE-2025-6295MEDIUMcode-projects Hostel Management System allocated_rooms.php sql injectionEPSS 0.5%CVE-2025-5364MEDIUMCampcodes Online Hospital Management System add-patient.php sql injectionEPSS 0.5%CVE-2025-4884MEDIUMitsourcecode Restaurant Management System assign_save.php sql injectionEPSS 0.5%CVE-2025-4504MEDIUMSourceCodester Online College Library System index.php sql injectionEPSS 0.5%CVE-2025-5362MEDIUMCampcodes Online Hospital Management System doctor-specilization.php sql injectionEPSS 0.5%CVE-2025-4509MEDIUMPHPGurukul e-Diary Management System manage-notes.php sql injectionEPSS 0.5%CVE-2025-4925MEDIUMPHPGurukul Daily Expense Tracker System expense-monthwise-reports-detailed.php sql injectionEPSS 0.5%CVE-2025-5229MEDIUMCampcodes Online Hospital Management System view-patient.php sql injectionEPSS 0.5%CVE-2025-4936MEDIUMprojectworlds Online Food Ordering System admin-page.php sql injectionEPSS 0.5%CVE-2024-56835HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEEPSS 0.5%CVE-2025-4927MEDIUMPHPGurukul Online Marriage Registration System between-dates-application-report.php sql injectionEPSS 0.5%CVE-2025-4553MEDIUMPHPGurukul Apartment Visitors Management System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-4869MEDIUMitsourcecode Restaurant Management System member_update.php sql injectionEPSS 0.5%CVE-2025-4505MEDIUMPHPGurukul Apartment Visitors Management System category.php sql injectionEPSS 0.5%CVE-2025-5360MEDIUMCampcodes Online Hospital Management System book-appointment.php sql injectionEPSS 0.5%