Weaknesses of type CWE-74

4,769 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-3245MEDIUMitsourcecode Library Management System Forgot.java search sql injectionEPSS 0.5%CVE-2025-3242MEDIUMPHPGurukul e-Diary Management System search-result.php sql injectionEPSS 0.5%CVE-2026-3751MEDIUMSourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injectionEPSS 0.5%CVE-2025-4352MEDIUMBrilliance Golden Link Secondary System tcEntrFlowSelect.htm sql injectionEPSS 0.5%CVE-2025-8502MEDIUMcode-projects Online Medicine Guide changepass.php sql injectionEPSS 0.5%CVE-2025-8494MEDIUMcode-projects Intern Membership Management System delete_student.php sql injectionEPSS 0.5%CVE-2025-8495MEDIUMcode-projects Intern Membership Management System edit_admin_query.php sql injectionEPSS 0.5%CVE-2025-1859MEDIUMPHPGurukul News Portal login.php sql injectionEPSS 0.5%CVE-2025-2951MEDIUMBluestar Micro Mall data.php sql injectionEPSS 0.5%CVE-2025-5430MEDIUMAssamLook CMS product.php sql injectionEPSS 0.5%CVE-2025-7915MEDIUMChanjet CRM Login Page mailinactive.php sql injectionEPSS 0.5%CVE-2026-27203HIGHeBay API MCP Server Affected by Environment Variable InjectionEPSS 0.5%CVE-2025-4247MEDIUMSourceCodester Simple To-Do List System delete_task.php sql injectionEPSS 0.5%CVE-2025-5211MEDIUMPHPGurukul Employee Record Management System myprofile.php sql injectionEPSS 0.5%CVE-2025-4263MEDIUMPHPGurukul Online DJ Booking Management System booking-search.php sql injectionEPSS 0.5%CVE-2025-4265MEDIUMPHPGurukul Emergency Ambulance Hiring Portal contact-us.php sql injectionEPSS 0.5%CVE-2024-12999MEDIUMPHPGurukul Small CRM edit-user.php sql injectionEPSS 0.5%CVE-2025-4262MEDIUMPHPGurukul Online DJ Booking Management System user-search.php sql injectionEPSS 0.5%CVE-2025-5212MEDIUMPHPGurukul Employee Record Management System editempexp.php sql injectionEPSS 0.5%CVE-2025-5213MEDIUMprojectworlds Responsive E-Learning System delete_file.php sql injectionEPSS 0.5%