Weaknesses of type CWE-74

4,777 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-3790MEDIUMSourceCodester Sales and Inventory System POST Parameter check_supplier_details.php sql injectionEPSS 0.5%CVE-2025-8498MEDIUMcode-projects Online Medicine Guide index.php sql injectionEPSS 0.5%CVE-2025-8503MEDIUMcode-projects Online Medicine Guide adaddmed.php sql injectionEPSS 0.5%CVE-2025-8497MEDIUMcode-projects Online Medicine Guide cusfindphar2.php sql injectionEPSS 0.5%CVE-2026-3755MEDIUMSourceCodester Sales and Inventory System POST check_customer_details.php sql injectionEPSS 0.5%CVE-2026-3771MEDIUMSourceCodester/janobe Resort Reservation System accomodation.php sql injectionEPSS 0.5%CVE-2026-4570MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injectionEPSS 0.5%CVE-2026-3754MEDIUMSourceCodester Sales and Inventory System add_stock.php sql injectionEPSS 0.5%CVE-2025-2737MEDIUMPHPGurukul Old Age Home Management System contactus.php sql injectionEPSS 0.5%CVE-2026-3753MEDIUMSourceCodester Sales and Inventory System add_sales_print.php sql injectionEPSS 0.5%CVE-2026-4781MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injectionEPSS 0.5%CVE-2026-3792MEDIUMSourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injectionEPSS 0.5%CVE-2025-2738MEDIUMPHPGurukul Old Age Home Management System manage-scdetails.php sql injectionEPSS 0.5%CVE-2025-8496MEDIUMprojectworlds Online Admission System viewform.php sql injectionEPSS 0.5%CVE-2026-4533MEDIUMcode-projects Simple Food Ordering System all-tickets.php sql injectionEPSS 0.5%CVE-2026-3793MEDIUMSourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injectionEPSS 0.5%CVE-2026-4779MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injectionEPSS 0.5%CVE-2025-8270MEDIUMcode-projects Exam Form Submission delete_s2.php sql injectionEPSS 0.5%CVE-2025-7612MEDIUMcode-projects Mobile Shop login.php sql injectionEPSS 0.5%CVE-2025-9740MEDIUMcode-projects Human Resource Integrated System log_query.php sql injectionEPSS 0.5%