Weaknesses of type CWE-74

4,782 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-5432MEDIUMAssamLook CMS view_tender.php sql injectionEPSS 0.5%CVE-2025-15421MEDIUMYonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injectionEPSS 0.5%CVE-2026-57522LOWBitwarden Server < 2026.5.0 JSON Injection via Webhook TemplatesEPSS 0.5%CVE-2025-3353MEDIUMPHPGurukul Men Salon Management System add-services.php sql injectionEPSS 0.5%CVE-2024-12941MEDIUMCodeAstro Blood Donor Management System deletedannounce.php sql injectionEPSS 0.5%CVE-2025-4795MEDIUMgongfuxiang schoolcms index.php SaveInfo sql injectionEPSS 0.5%CVE-2025-3336MEDIUMcodeprojects Online Restaurant Management System member_save.php sql injectionEPSS 0.5%CVE-2025-3299MEDIUMPHPGurukul Men Salon Management System appointment.php sql injectionEPSS 0.5%CVE-2025-3335MEDIUMcodeprojects Online Restaurant Management System category_update.php sql injectionEPSS 0.5%CVE-2025-3337MEDIUMcodeprojects Online Restaurant Management System member_update.php sql injectionEPSS 0.5%CVE-2025-11664MEDIUMCampcodes Online Beauty Parlor Management System search-appointment.php sql injectionEPSS 0.5%CVE-2025-7199MEDIUMcode-projects Library System notapprove.php sql injectionEPSS 0.5%CVE-2025-6901MEDIUMcode-projects Inventory Management System removeUser.php sql injectionEPSS 0.5%CVE-2025-6836MEDIUMcode-projects Library System profile.php sql injectionEPSS 0.5%CVE-2025-6889MEDIUMcode-projects Movie Ticketing System logIn.php sql injectionEPSS 0.5%CVE-2025-7184MEDIUMcode-projects Library System books.php sql injectionEPSS 0.5%CVE-2025-6903MEDIUMcode-projects Car Rental System approve.php sql injectionEPSS 0.5%CVE-2025-7119MEDIUMCampcodes Complaint Management System index.php sql injectionEPSS 0.5%CVE-2025-7169MEDIUMcode-projects Crime Reporting System complainer_page.php sql injectionEPSS 0.5%CVE-2025-7197MEDIUMcode-projects Jonnys Liquor delete-row.php sql injectionEPSS 0.5%