Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-5226MEDIUMPHPGurukul Small CRM change-password.php sql injectionEPSS 0.4%CVE-2026-4236MEDIUMitsourcecode Online Enrollment System index.php sql injectionEPSS 0.4%CVE-2026-8133MEDIUMzyx0814 FilePress Shares Filelist API admin.php sql injectionEPSS 0.4%CVE-2025-10403MEDIUMPHPGurukul Beauty Parlour Management System view-enquiry.php sql injectionEPSS 0.4%CVE-2025-5227MEDIUMPHPGurukul Small CRM manage-tickets.php sql injectionEPSS 0.4%CVE-2025-9742MEDIUMcode-projects Human Resource Integrated System login.php sql injectionEPSS 0.4%CVE-2026-12888LOWHTML injection in the Canarytoken Google Chat notificationEPSS 0.4%CVE-2025-15393MEDIUMKohana KodiCMS Layout API Endpoint file.php save code injectionEPSS 0.4%CVE-2025-8936MEDIUM1000 Projects Sales Management System dordupdate.php sql injectionEPSS 0.4%CVE-2025-9933MEDIUMPHPGurukul Beauty Parlour Management System view-appointment.php sql injectionEPSS 0.4%CVE-2025-9925MEDIUMprojectworlds Travel Management System detail.php sql injectionEPSS 0.4%CVE-2025-11032MEDIUMkidaze CourseSelectionSystem COUNT3s6.php sql injectionEPSS 0.4%CVE-2026-48813HIGHFlawfinder output manipulation via untrusted filenames and source textEPSS 0.4%CVE-2025-5755MEDIUMSourceCodester Open Source Clinic Management System email_config.php sql injectionEPSS 0.4%CVE-2025-4704MEDIUMPHPGurukul Vehicle Parking Management System edit-category.php sql injectionEPSS 0.4%CVE-2026-25750HIGHLangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrlEPSS 0.4%CVE-2025-9924MEDIUMprojectworlds Travel Management System enquiry.php sql injectionEPSS 0.4%CVE-2025-9927MEDIUMprojectworlds Travel Management System viewpackage.php sql injectionEPSS 0.4%CVE-2025-9593MEDIUMitsourcecode Apartment Management System unit_status_info.php sql injectionEPSS 0.4%CVE-2025-11033MEDIUMkidaze CourseSelectionSystem COUNT3s7.php sql injectionEPSS 0.4%