Weaknesses of type CWE-74

4,772 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6456MEDIUMcode-projects Online Hotel Reservation System order.php sql injectionEPSS 0.5%CVE-2025-6448MEDIUMcode-projects Simple Online Hotel Reservation System delete_room.php sql injectionEPSS 0.5%CVE-2026-3149MEDIUMitsourcecode College Management System asign-single-student-subjects.php sql injectionEPSS 0.5%CVE-2025-6406MEDIUMCampcodes Online Hospital Management System forgot-password.php sql injectionEPSS 0.5%CVE-2025-6474MEDIUMcode-projects Inventory Management System changeUsername.php sql injectionEPSS 0.5%CVE-2025-6451MEDIUMcode-projects Simple Online Hotel Reservation System delete_pending.php sql injectionEPSS 0.5%CVE-2025-6446MEDIUMcode-projects Client Details System index.php sql injectionEPSS 0.5%CVE-2025-6479MEDIUMcode-projects Simple Pizza Ordering System salesreport.php sql injectionEPSS 0.5%CVE-2025-6123MEDIUMcode-projects Restaurant Order System payment.php sql injectionEPSS 0.5%CVE-2025-6468MEDIUMcode-projects Online Bidding System bidnow.php sql injectionEPSS 0.5%CVE-2025-6405MEDIUMCampcodes Online Teacher Record Management System edit-teacher-detail.php sql injectionEPSS 0.5%CVE-2025-6407MEDIUMCampcodes Online Hospital Management System user-login.php sql injectionEPSS 0.5%CVE-2026-3786MEDIUMEasyCMS Request Parameter RbacuserAction.class.php sql injectionEPSS 0.5%CVE-2026-3150MEDIUMitsourcecode College Management System display-teacher.php sql injectionEPSS 0.5%CVE-2025-6611MEDIUMcode-projects Inventory Management System createBrand.php sql injectionEPSS 0.5%CVE-2025-6316MEDIUMcode-projects Online Shoe Store admin_running.php sql injectionEPSS 0.5%CVE-2025-6665MEDIUMcode-projects Inventory Management System editBrand.php sql injectionEPSS 0.5%CVE-2025-5367MEDIUMPHPGurukul Online Shopping Portal Project category.php sql injectionEPSS 0.5%CVE-2025-6318MEDIUMPHPGurukul Pre-School Enrollment System check_availability.php sql injectionEPSS 0.5%CVE-2025-15148MEDIUMCmsEasy Backend Template Management template_admin.php savetemp_action code injectionEPSS 0.5%