Fallos del tipo CWE-74

4769 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2024-56835HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEEPSS 0.5%CVE-2025-5363MEDIUMCampcodes Online Hospital Management System index.php sql injectionEPSS 0.5%CVE-2025-4869MEDIUMitsourcecode Restaurant Management System member_update.php sql injectionEPSS 0.5%CVE-2025-5251MEDIUMPHPGurukul News Portal Project edit-subcategory.php sql injectionEPSS 0.5%CVE-2025-5246MEDIUMCampcodes Online Hospital Management System query-details.php sql injectionEPSS 0.5%CVE-2025-5707MEDIUMPHPGurukul Human Metapneumovirus Testing Management System registered-user-testing.php sql injectionEPSS 0.5%CVE-2025-5360MEDIUMCampcodes Online Hospital Management System book-appointment.php sql injectionEPSS 0.5%CVE-2025-4928MEDIUMprojectworlds Online Lawyer Management System save_lawyer_edit_profile.php sql injectionEPSS 0.5%CVE-2025-4507MEDIUMCampcodes Online Food Ordering System add-item.php sql injectionEPSS 0.5%CVE-2025-4554MEDIUMPHPGurukul Apartment Visitors Management System bwdates-passreports-details.php sql injectionEPSS 0.5%CVE-2025-4508MEDIUMPHPGurukul e-Diary Management System my-profile.php sql injectionEPSS 0.5%CVE-2025-6293MEDIUMcode-projects Hostel Management System contact_manager.php sql injectionEPSS 0.5%CVE-2025-5359MEDIUMCampcodes Online Hospital Management System appointment-history.php sql injectionEPSS 0.5%CVE-2025-5056MEDIUMCampcodes Online Shopping Portal edit-products.php sql injectionEPSS 0.5%CVE-2025-5358MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-6296MEDIUMcode-projects Hostel Management System empty_rooms.php sql injectionEPSS 0.5%CVE-2025-5224MEDIUMCampcodes Online Hospital Management System add-doctor.php sql injectionEPSS 0.5%CVE-2025-4927MEDIUMPHPGurukul Online Marriage Registration System between-dates-application-report.php sql injectionEPSS 0.5%CVE-2025-4885MEDIUMitsourcecode Sales and Inventory System product_add.php sql injectionEPSS 0.5%CVE-2025-4249MEDIUMPHPGurukul e-Diary Management System manage-categories.php sql injectionEPSS 0.5%