Weaknesses of type CWE-74

4,776 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2025-15394MEDIUMiCMS POST Parameter ConfigAdmincp.php save code injectionEPSS 0.5%CVE-2025-15243MEDIUMcode-projects Simple Stock System login.php sql injectionEPSS 0.5%CVE-2025-8469MEDIUMSourceCodester Online Hotel Reservation System deletegallery.php sql injectionEPSS 0.5%CVE-2025-8470MEDIUMSourceCodester Online Hotel Reservation System deleteroom.php sql injectionEPSS 0.5%CVE-2025-9789MEDIUMSourceCodester Online Hotel Reservation System edituser.php sql injectionEPSS 0.5%CVE-2025-12306MEDIUMcode-projects Nero Social Networking Site acceptoffres.php sql injectionEPSS 0.5%CVE-2025-10812MEDIUMcode-projects Hostel Management System index.php sql injectionEPSS 0.5%CVE-2025-10624MEDIUMPHPGurukul User Management System login.php sql injectionEPSS 0.5%CVE-2025-10832MEDIUMSourceCodester Pet Grooming Management Software fetch_product_details.php sql injectionEPSS 0.5%CVE-2025-11063MEDIUMCampcodes Online Learning Management System edit_department.php sql injectionEPSS 0.5%CVE-2025-12208MEDIUMSourceCodester Best House Rental Management System admin_class.php login2 sql injectionEPSS 0.5%CVE-2025-11064MEDIUMCampcodes Online Learning Management System teachers.php sql injectionEPSS 0.5%CVE-2025-10108MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 0.5%CVE-2025-10599MEDIUMitsourcecode Web-Based Internet Laboratory Management System login.php AuthenticateUser sql injectionEPSS 0.5%CVE-2025-11608MEDIUMcode-projects E-Banking System POST Parameter register.php sql injectionEPSS 0.5%CVE-2025-10445MEDIUMCampcodes Computer Sales and Inventory System us_transac.php sql injectionEPSS 0.5%CVE-2025-10687MEDIUMSourceCodester Responsive E-Learning System add_teacher.php sql injectionEPSS 0.5%CVE-2025-12309MEDIUMcode-projects Nero Social Networking Site friendprofile.php sql injectionEPSS 0.5%CVE-2025-10788MEDIUMSourceCodester Online Hotel Reservation System deleteroominventory.php sql injectionEPSS 0.5%