Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-5669MEDIUMPHPGurukul Medical Card Generation System unreadenq.php sql injectionEPSS 0.5%CVE-2025-6605MEDIUMSourceCodester Best Salon Management System edit-staff.php sql injectionEPSS 0.5%CVE-2025-6412MEDIUMPHPGurukul Art Gallery Management System changeimage.php sql injectionEPSS 0.5%CVE-2025-6414MEDIUMPHPGurukul Art Gallery Management System changeimage2.php sql injectionEPSS 0.5%CVE-2025-6581MEDIUMSourceCodester Best Salon Management System add-customer.php sql injectionEPSS 0.5%CVE-2025-5652MEDIUMPHPGurukul Complaint Management System between-date-complaintreport.php sql injectionEPSS 0.5%CVE-2025-6410MEDIUMPHPGurukul Art Gallery Management System edit-art-medium-detail.php sql injectionEPSS 0.5%CVE-2025-6413MEDIUMPHPGurukul Art Gallery Management System changeimage1.php sql injectionEPSS 0.5%CVE-2025-6606MEDIUMSourceCodester Best Salon Management System add-services.php sql injectionEPSS 0.5%CVE-2025-6416MEDIUMPHPGurukul Art Gallery Management System changeimage4.php sql injectionEPSS 0.5%CVE-2025-9832MEDIUMSourceCodester Food Ordering Management System register-router.php sql injectionEPSS 0.5%CVE-2025-9053MEDIUMprojectworlds Travel Management System updatesubcategory.php sql injectionEPSS 0.5%CVE-2025-5176MEDIUMRealce Tecnologia Queue Ticket Kiosk Admin Login Page index.php sql injectionEPSS 0.5%CVE-2025-6583MEDIUMSourceCodester Best Salon Management System view-appointment.php sql injectionEPSS 0.5%CVE-2025-5616MEDIUMPHPGurukul Online Fire Reporting System profile.php sql injectionEPSS 0.5%CVE-2025-9829MEDIUMPHPGurukul Beauty Parlour Management System signup.php sql injectionEPSS 0.5%CVE-2025-5615MEDIUMPHPGurukul Online Fire Reporting System details.php sql injectionEPSS 0.5%CVE-2025-12261MEDIUMCodeAstro Gym Management System remove-announcement.php sql injectionEPSS 0.5%CVE-2025-14711MEDIUMFantasticLBP Hotels Server hotelList.php sql injectionEPSS 0.5%CVE-2025-9757MEDIUMCampcodes/SourceCodester Courier Management System ajax.php login sql injectionEPSS 0.5%