Weaknesses of type CWE-74

4,769 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-11309MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findDeptPage.do doFilter sql injectionEPSS 0.5%CVE-2026-27022MEDIUMRediSearch Query Injection in @langchain/langgraph-checkpoint-redisEPSS 0.5%CVE-2026-1120MEDIUMYonyou KSOA HTTP GET Parameter del_work.jsp sql injectionEPSS 0.5%CVE-2025-5155MEDIUMqianfox FoxCMS Article.php batchCope sql injectionEPSS 0.5%CVE-2025-2649MEDIUMPHPGurukul Doctor Appointment Management System check-appointment.php sql injectionEPSS 0.5%CVE-2025-2647MEDIUMPHPGurukul Art Gallery Management System search.php sql injectionEPSS 0.5%CVE-2025-2679MEDIUMPHPGurukul Bank Locker Management System contact-us.php sql injectionEPSS 0.5%CVE-2025-2648MEDIUMPHPGurukul Art Gallery Management System view-enquiry-detail.php sql injectionEPSS 0.5%CVE-2025-2676MEDIUMPHPGurukul Bank Locker Management System add-subadmin.php sql injectionEPSS 0.5%CVE-2025-2680MEDIUMPHPGurukul Bank Locker Management System edit-assign-locker.php sql injectionEPSS 0.5%CVE-2025-0950MEDIUMitsourcecode Tailoring Management System staffview.php sql injectionEPSS 0.5%CVE-2025-5708MEDIUMcode-projects Real Estate Property Management System NewsReport.php sql injectionEPSS 0.5%CVE-2026-1701MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.5%CVE-2026-2822MEDIUMJeecgBoot Backend airag_app,1,create_by sql injectionEPSS 0.5%CVE-2026-3751MEDIUMSourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injectionEPSS 0.5%CVE-2025-3235MEDIUMPHPGurukul Old Age Home Management System profile.php sql injectionEPSS 0.5%CVE-2026-3752MEDIUMSourceCodester Employee Task Management System GET Parameter daily-task-report.php sql injectionEPSS 0.5%CVE-2025-3242MEDIUMPHPGurukul e-Diary Management System search-result.php sql injectionEPSS 0.5%CVE-2025-3245MEDIUMitsourcecode Library Management System Forgot.java search sql injectionEPSS 0.5%CVE-2025-3204MEDIUMCodeAstro Car Rental System returncar.php sql injectionEPSS 0.5%