Weaknesses of type CWE-74

4,777 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-8273MEDIUMcode-projects Exam Form Submission update_s8.php sql injectionEPSS 0.5%CVE-2025-10396MEDIUMSourceCodester Pet Grooming Management Software edit_role.php sql injectionEPSS 0.5%CVE-2025-7467MEDIUMcode-projects Modern Bag product-detail.php sql injectionEPSS 0.5%CVE-2025-8272MEDIUMcode-projects Exam Form Submission update_fst.php sql injectionEPSS 0.5%CVE-2025-6134MEDIUMProjectworlds Life Insurance Management System insertClient.php sql injectionEPSS 0.5%CVE-2025-9733MEDIUMcode-projects Human Resource Integrated System login_timeee.php sql injectionEPSS 0.5%CVE-2025-0462MEDIUMShanghai Lingdang Information Technology Lingdang CRM index.php sql injectionEPSS 0.5%CVE-2025-6133MEDIUMProjectworlds Life Insurance Management System insertagent.php sql injectionEPSS 0.5%CVE-2025-9740MEDIUMcode-projects Human Resource Integrated System log_query.php sql injectionEPSS 0.5%CVE-2025-8271MEDIUMcode-projects Exam Form Submission delete_s3.php sql injectionEPSS 0.5%CVE-2025-7541MEDIUMcode-projects Online Appointment Booking System get_town.php sql injectionEPSS 0.5%CVE-2025-9749MEDIUMHKritesh009 Grocery List Management Web App update.php sql injectionEPSS 0.5%CVE-2025-6136MEDIUMProjectworlds Life Insurance Management System insertPayment.php sql injectionEPSS 0.5%CVE-2025-5613MEDIUMPHPGurukul Online Fire Reporting System request-details.php sql injectionEPSS 0.5%CVE-2025-5617MEDIUMPHPGurukul Online Fire Reporting System manage-teams.php sql injectionEPSS 0.5%CVE-2025-5618MEDIUMPHPGurukul Online Fire Reporting System edit-team.php sql injectionEPSS 0.5%CVE-2025-9743MEDIUMcode-projects Human Resource Integrated System login_attendance2.php sql injectionEPSS 0.5%CVE-2025-6135MEDIUMProjectworlds Life Insurance Management System insertNominee.php sql injectionEPSS 0.5%CVE-2025-5612MEDIUMPHPGurukul Online Fire Reporting System reporting.php sql injectionEPSS 0.5%CVE-2025-7542MEDIUMPHPGurukul User Registration & Login and User Management System user-profile.php sql injectionEPSS 0.5%