Weaknesses of type CWE-74

4,772 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6468MEDIUMcode-projects Online Bidding System bidnow.php sql injectionEPSS 0.5%CVE-2025-6407MEDIUMCampcodes Online Hospital Management System user-login.php sql injectionEPSS 0.5%CVE-2025-6405MEDIUMCampcodes Online Teacher Record Management System edit-teacher-detail.php sql injectionEPSS 0.5%CVE-2026-3785MEDIUMEasyCMS Request Parameter RbacnodeAction.class.php sql injectionEPSS 0.5%CVE-2025-6469MEDIUMcode-projects Online Bidding System details.php sql injectionEPSS 0.5%CVE-2025-6579MEDIUMcode-projects Car Rental System message_admin.php sql injectionEPSS 0.5%CVE-2025-6316MEDIUMcode-projects Online Shoe Store admin_running.php sql injectionEPSS 0.5%CVE-2025-6665MEDIUMcode-projects Inventory Management System editBrand.php sql injectionEPSS 0.5%CVE-2026-3786MEDIUMEasyCMS Request Parameter RbacuserAction.class.php sql injectionEPSS 0.5%CVE-2025-6311MEDIUMCampcodes Sales and Inventory System account_add.php sql injectionEPSS 0.5%CVE-2025-6323MEDIUMPHPGurukul Pre-School Enrollment System enrollment.php sql injectionEPSS 0.5%CVE-2025-6455MEDIUMcode-projects Online Hotel Reservation System messageexec.php sql injectionEPSS 0.5%CVE-2025-5599MEDIUMPHPGurukul Student Result Management System editmyexp.php sql injectionEPSS 0.5%CVE-2025-3984LOWApereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injectionEPSS 0.5%CVE-2025-6449MEDIUMcode-projects Simple Online Hotel Reservation System checkout_query.php sql injectionEPSS 0.5%CVE-2025-5860MEDIUMPHPGurukul Maid Hiring Management System search-booking-request.php sql injectionEPSS 0.5%CVE-2025-6322MEDIUMPHPGurukul Pre-School Enrollment System visit.php sql injectionEPSS 0.5%CVE-2025-6668MEDIUMcode-projects Inventory Management System fetchSelectedBrand.php sql injectionEPSS 0.5%CVE-2026-3487MEDIUMitsourcecode College Management System class-result.php sql injectionEPSS 0.5%CVE-2025-6472MEDIUMcode-projects Online Bidding System showprod.php sql injectionEPSS 0.5%