Weaknesses of type CWE-74

4,782 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-55615CRITICALLangroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879EPSS 0.5%CVE-2023-7114HIGHMattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.EPSS 0.5%CVE-2025-13201MEDIUMcode-projects Simple Cafe Ordering System login.php sql injectionEPSS 0.5%CVE-2025-4696MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System search.php sql injectionEPSS 0.5%CVE-2026-1122MEDIUMYonyou KSOA HTTP GET Parameter work_info.jsp sql injectionEPSS 0.5%CVE-2025-13792MEDIUMQualitor getResumo.php eval code injectionEPSS 0.5%CVE-2026-1123MEDIUMYonyou KSOA HTTP GET Parameter work_mod.jsp sql injectionEPSS 0.5%CVE-2026-50107HIGHNGINX Gateway Fabric vulnerabilityEPSS 0.5%CVE-2025-12326MEDIUMshawon100 RUET OJ POST Request process.php sql injectionEPSS 0.5%CVE-2025-14837MEDIUMZZCMS Backend Website Settings siteconfig.php stripfxg code injectionEPSS 0.5%CVE-2025-14729MEDIUMCTCMS Content Management System Backend App Configuration Ct_App.php save code injectionEPSS 0.5%CVE-2025-3229MEDIUMPHPGurukul Restaurant Table Booking System edit-subadmin.php sql injectionEPSS 0.5%CVE-2025-14730MEDIUMCTCMS Content Management System Backend System Configuration Ct_Config.php code injectionEPSS 0.5%CVE-2025-15074MEDIUMitsourcecode Online Frozen Foods Ordering System customer_details.php sql injectionEPSS 0.5%CVE-2025-3206MEDIUMcode-projects Hospital Management System doctor-specilization.php sql injectionEPSS 0.5%CVE-2026-1124MEDIUMYonyou KSOA HTTP GET Parameter work_report.jsp sql injectionEPSS 0.5%CVE-2025-15424MEDIUMYonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injectionEPSS 0.5%CVE-2025-15421MEDIUMYonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injectionEPSS 0.5%CVE-2025-5432MEDIUMAssamLook CMS view_tender.php sql injectionEPSS 0.5%CVE-2026-41234HIGHFroxlor: BIND Zone File Injection via TXT Record ContentEPSS 0.5%