Weaknesses of type CWE-74

4,772 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6458MEDIUMcode-projects Online Hotel Reservation System execedituser.php sql injectionEPSS 0.5%CVE-2025-6310MEDIUMPHPGurukul Emergency Ambulance Hiring Portal index.php sql injectionEPSS 0.5%CVE-2026-3486MEDIUMitsourcecode College Management System student-fee.php sql injectionEPSS 0.5%CVE-2026-3785MEDIUMEasyCMS Request Parameter RbacnodeAction.class.php sql injectionEPSS 0.5%CVE-2025-6471MEDIUMcode-projects Online Bidding System administrator sql injectionEPSS 0.5%CVE-2025-6307MEDIUMcode-projects Online Shoe Store edit_customer.php sql injectionEPSS 0.5%CVE-2025-6467MEDIUMcode-projects Online Bidding System login.php sql injectionEPSS 0.5%CVE-2025-6456MEDIUMcode-projects Online Hotel Reservation System order.php sql injectionEPSS 0.5%CVE-2025-6472MEDIUMcode-projects Online Bidding System showprod.php sql injectionEPSS 0.5%CVE-2026-3150MEDIUMitsourcecode College Management System display-teacher.php sql injectionEPSS 0.5%CVE-2025-6317MEDIUMcode-projects Online Shoe Store confirm.php sql injectionEPSS 0.5%CVE-2025-5650MEDIUM1000projects Online Notice Board register.php sql injectionEPSS 0.5%CVE-2025-6447MEDIUMcode-projects Simple Online Hotel Reservation System index.php sql injectionEPSS 0.5%CVE-2025-6306MEDIUMcode-projects Online Shoe Store admin_index.php sql injectionEPSS 0.5%CVE-2025-6481MEDIUMcode-projects Simple Pizza Ordering System update.php sql injectionEPSS 0.5%CVE-2025-5376MEDIUMSourceCodester Health Center Patient Record Management System patient.php sql injectionEPSS 0.5%CVE-2026-3786MEDIUMEasyCMS Request Parameter RbacuserAction.class.php sql injectionEPSS 0.5%CVE-2025-6483MEDIUMcode-projects Simple Pizza Ordering System edituser.php sql injectionEPSS 0.5%CVE-2025-6469MEDIUMcode-projects Online Bidding System details.php sql injectionEPSS 0.5%CVE-2025-6318MEDIUMPHPGurukul Pre-School Enrollment System check_availability.php sql injectionEPSS 0.5%