Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6891MEDIUMcode-projects Inventory Management System createUser.php sql injectionEPSS 0.5%CVE-2025-7119MEDIUMCampcodes Complaint Management System index.php sql injectionEPSS 0.5%CVE-2025-3303MEDIUMcode-projects Patient Record Management System birthing_record.php sql injectionEPSS 0.5%CVE-2025-7168MEDIUMcode-projects Crime Reporting System userlogin.php sql injectionEPSS 0.5%CVE-2025-6917MEDIUMcode-projects Online Hotel Booking registration.php sql injectionEPSS 0.5%CVE-2025-7197MEDIUMcode-projects Jonnys Liquor delete-row.php sql injectionEPSS 0.5%CVE-2025-6840MEDIUMcode-projects Product Inventory System Login index.php sql injectionEPSS 0.5%CVE-2025-7199MEDIUMcode-projects Library System notapprove.php sql injectionEPSS 0.5%CVE-2025-6901MEDIUMcode-projects Inventory Management System removeUser.php sql injectionEPSS 0.5%CVE-2025-7184MEDIUMcode-projects Library System books.php sql injectionEPSS 0.5%CVE-2025-6906MEDIUMcode-projects Car Rental System login.php sql injectionEPSS 0.5%CVE-2025-6907MEDIUMcode-projects Car Rental System book_car.php sql injectionEPSS 0.5%CVE-2025-6835MEDIUMcode-projects Library System student-issue-book.php sql injectionEPSS 0.5%CVE-2025-7185MEDIUMcode-projects Library System approve.php sql injectionEPSS 0.5%CVE-2025-7157MEDIUMcode-projects Online Note Sharing login.php sql injectionEPSS 0.5%CVE-2025-6885MEDIUMPHPGurukul Teachers Record Management System edit-teacher-detail.php sql injectionEPSS 0.5%CVE-2025-67746LOWComposer vulnerable to ANSI sequence injectionEPSS 0.5%CVE-2025-3207MEDIUMcode-projects Patient Record Management System birthing_form.php sql injectionEPSS 0.5%CVE-2025-3211MEDIUMcode-projects Patient Record Management System birthing_print.php sql injectionEPSS 0.5%CVE-2025-9417MEDIUMitsourcecode Apartment Management System addemployee.php sql injectionEPSS 0.5%