Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-12261MEDIUMCodeAstro Gym Management System remove-announcement.php sql injectionEPSS 0.5%CVE-2025-9829MEDIUMPHPGurukul Beauty Parlour Management System signup.php sql injectionEPSS 0.5%CVE-2025-5615MEDIUMPHPGurukul Online Fire Reporting System details.php sql injectionEPSS 0.5%CVE-2025-5614MEDIUMPHPGurukul Online Fire Reporting System search-report-result.php sql injectionEPSS 0.5%CVE-2025-14711MEDIUMFantasticLBP Hotels Server hotelList.php sql injectionEPSS 0.5%CVE-2025-0489MEDIUMFanli2012 native-php-cms friendlink_dodel.php sql injectionEPSS 0.4%CVE-2025-0488MEDIUMFanli2012 native-php-cms product_list.php sql injectionEPSS 0.4%CVE-2023-6004MEDIUMLibssh: proxycommand/proxyjump features allow injection of malicious code through hostnameEPSS 0.4%CVE-2026-19988MEDIUMAlaev SEO Tools Extension Popup UI popup.html addDiv cross site scriptingEPSS 0.4%CVE-2025-3956MEDIUM201206030 novel-cloud BookInfoMapper.xml RestResp sql injectionEPSS 0.4%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.4%CVE-2026-68747LOWCSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration inputEPSS 0.4%CVE-2025-15183MEDIUMcode-projects Refugee Food Management System viewtakenfd.php sql injectionEPSS 0.4%CVE-2026-1059MEDIUMFeMiner wms chkuser.php sql injectionEPSS 0.4%CVE-2026-54543MEDIUMFroxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsEPSS 0.4%CVE-2024-12939MEDIUMcode-projects Job Recruitment _all_edits.php add_edu sql injectionEPSS 0.4%CVE-2025-15436MEDIUMYonyou KSOA work_edit.jsp sql injectionEPSS 0.4%CVE-2025-1374MEDIUMcode-projects Real Estate Property Management System search.php sql injectionEPSS 0.4%CVE-2025-0531MEDIUMcode-projects Chat System leaveroom.php sql injectionEPSS 0.4%CVE-2025-9768MEDIUMitsourcecode Sports Management System mode.php sql injectionEPSS 0.4%