Weaknesses of type CWE-74

4,779 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-7478MEDIUMcode-projects Modern Bag category-list.php sql injectionEPSS 0.5%CVE-2025-7475MEDIUMcode-projects Simple Car Rental System pay.php sql injectionEPSS 0.5%CVE-2026-55427HIGHCoder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`EPSS 0.5%CVE-2025-7749MEDIUMcode-projects Online Appointment Booking System getmanagerregion.php sql injectionEPSS 0.5%CVE-2025-5493MEDIUMBaison Channel Middleware Product ToJsonByControlName sql injectionEPSS 0.5%CVE-2025-7476MEDIUMcode-projects Simple Car Rental System approve.php sql injectionEPSS 0.5%CVE-2025-7534MEDIUMPHPGurukul Student Result Management System GET Parameter notice-details.php sql injectionEPSS 0.5%CVE-2025-1189MEDIUM1000 Projects Attendance Tracking Management System chart1.php sql injectionEPSS 0.5%CVE-2026-42334HIGHMongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionEPSS 0.5%CVE-2026-50574HIGHyt-dlp: Arbitrary code execution via manifest downloads with aria2cEPSS 0.5%CVE-2026-0284MEDIUMPAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)EPSS 0.5%CVE-2025-1210MEDIUMcode-projects Wazifa System control.php sql injectionEPSS 0.5%CVE-2025-1581MEDIUMPHPGurukul Online Nurse Hiring System book-nurse.php sql injectionEPSS 0.5%CVE-2025-4267MEDIUMSourceCodester/oretnom23 Stock Management System Purchase Order Details Page view_po sql injectionEPSS 0.5%CVE-2025-6936MEDIUMcode-projects Simple Pizza Ordering System addpro.php sql injectionEPSS 0.5%CVE-2025-8125MEDIUMdeerwms deer-wms-2 allocatedList sql injectionEPSS 0.5%CVE-2024-11096MEDIUMcode-projects Task Manager newProject.php sql injectionEPSS 0.5%CVE-2025-6935MEDIUMCampcodes Sales and Inventory System payment_add.php sql injectionEPSS 0.5%CVE-2024-53860HIGHPotential Abuse for Sending Arbitrary Emails in sp-php-email-handlerEPSS 0.5%CVE-2025-6937MEDIUMcode-projects Simple Pizza Ordering System large.php sql injectionEPSS 0.5%