Falhas do tipo CWE-74

4.745 resultados

Injeção de código

Ocorre quando dados não confiáveis (entrada do usuário) são incorporados diretamente em comandos ou consultas executadas pelo sistema, sem validação ou escape. Um atacante consegue injetar código malicioso (SQL, script, comando) que será interpretado e executado com os privilégios da aplicação.

Exemplo

Uma busca por usuário que concatena a entrada diretamente em SQL: `SELECT * FROM users WHERE name = '` + input + `'`. Se o usuário digitar `' OR '1'='1`, a consulta retorna todos os registros. Com entrada maliciosa como `'; DROP TABLE users; --`, o banco é destruído.

Como mitigar

Use prepared statements ou queries parametrizadas (placeholders) para separar dados de código. Valide e sanitize todas as entradas, aplicando listas de permissão quando possível. Implemente o princípio do menor privilégio: a conta de banco de dados da aplicação deve ter apenas permissões necessárias.

CVE-2024-11631MEDIUMitsourcecode Tailoring Management System expedit.php sql injectionEPSS 0.7%CVE-2024-40137MEDIUMDolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameterEPSS 0.7%CVE-2026-30932HIGHFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIEPSS 0.7%CVE-2025-3164MEDIUMTencent Music Entertainment SuperSonic H2 Database Connection testConnect code injectionEPSS 0.7%CVE-2024-46983CRITICALRemote Command Execution(RCE) Vulnerbility in sofa-hessianEPSS 0.7%CVE-2025-0294MEDIUMSourceCodester Home Clean Services Management System process.php sql injectionEPSS 0.7%CVE-2026-49097MEDIUMApache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or usersEPSS 0.7%CVE-2025-1173MEDIUM1000 Projects Bookstore Management System process_users_del.php sql injectionEPSS 0.7%CVE-2024-50572HIGHA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.7%CVE-2023-7096MEDIUMcode-projects Faculty Management System crud.php sql injectionEPSS 0.7%CVE-2026-15497MEDIUMSonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injectionEPSS 0.7%CVE-2025-3401MEDIUMESAFENET CDG getLimitIPList.jsp sql injectionEPSS 0.7%CVE-2026-25586CRITICALSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionEPSS 0.7%CVE-2025-3400MEDIUMESAFENET CDG UnChkMailApplication.jsp sql injectionEPSS 0.7%CVE-2025-3399MEDIUMESAFENET CDG updateNotice.jsp sql injectionEPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2025-4491MEDIUMCampcodes Online Food Ordering System ticket-status.php sql injectionEPSS 0.7%CVE-2026-4998MEDIUMSinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injectionEPSS 0.7%CVE-2025-4489MEDIUMCampcodes Online Food Ordering System user-router.php sql injectionEPSS 0.7%CVE-2025-4490MEDIUMCampcodes Online Food Ordering System view-ticket-admin.php sql injectionEPSS 0.7%