Weaknesses of type CWE-74

4,772 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-4940MEDIUM1000 Projects Daily College Class Work Report Book admin_info.php sql injectionEPSS 0.5%CVE-2025-6834MEDIUMcode-projects Inventory Management System editPayment.php sql injectionEPSS 0.5%CVE-2025-9664MEDIUMcode-projects Simple Grading System Admin Panel add_student_grade.php sql injectionEPSS 0.5%CVE-2025-9413MEDIUMlostvip-com ruoyi-go system_router.go SelectListByPage sql injectionEPSS 0.5%CVE-2025-6480MEDIUMcode-projects Simple Pizza Ordering System addcatexec.php sql injectionEPSS 0.5%CVE-2025-8493MEDIUMcode-projects Intern Membership Management System edit_student_query.php sql injectionEPSS 0.5%CVE-2026-1105MEDIUMEasyCMS UserAction.class.php sql injectionEPSS 0.5%CVE-2024-13078MEDIUMPHPGurukul Land Record System index.php sql injectionEPSS 0.5%CVE-2025-0334MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%CVE-2025-1580MEDIUMPHPGurukul Nipah Virus Testing Management System search-report-result.php sql injectionEPSS 0.5%CVE-2025-0541MEDIUMCodezips Gym Management System edit_member.php sql injectionEPSS 0.5%CVE-2025-0231MEDIUMCodezips Gym Management System submit_payments.php sql injectionEPSS 0.5%CVE-2025-0345MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%CVE-2025-14257MEDIUMitsourcecode Student Management System newrecord.php sql injectionEPSS 0.5%CVE-2026-3711MEDIUMcode-projects Simple Flight Ticket Booking System Adminupdate.php sql injectionEPSS 0.5%CVE-2026-3710MEDIUMcode-projects Simple Flight Ticket Booking System Adminadd.php sql injectionEPSS 0.5%CVE-2025-14256MEDIUMitsourcecode Student Management System newcurriculm.php sql injectionEPSS 0.5%CVE-2025-1201MEDIUMSourceCodester Best Church Management Software profile_crud.php sql injectionEPSS 0.5%CVE-2025-5365MEDIUMCampcodes Online Hospital Management System patient-search.php sql injectionEPSS 0.5%CVE-2025-6469MEDIUMcode-projects Online Bidding System details.php sql injectionEPSS 0.5%