Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-15127MEDIUMFantasticLBP Hotels_Server Room.php sql injectionEPSS 0.4%CVE-2025-14856MEDIUMy_project RuoYi getnames code injectionEPSS 0.4%CVE-2024-10491MEDIUMPreload arbitrary resources by injecting additional `Link` headersEPSS 0.4%CVE-2025-13572MEDIUMprojectworlds Advanced Library Management System delete_admin.php sql injectionEPSS 0.4%CVE-2025-13422MEDIUMfreeprojectscodes Sports Club Management System change_s_pwd.php sql injectionEPSS 0.4%CVE-2025-12928MEDIUMcode-projects Online Job Search Engine login.php sql injectionEPSS 0.4%CVE-2025-13060MEDIUMSourceCodester Survey Application System view_survey.php sql injectionEPSS 0.4%CVE-2025-13323MEDIUMcode-projects Simple Pizza Ordering System listorder.php sql injectionEPSS 0.4%CVE-2025-8158MEDIUMPHPGurukul Login and User Management System yesterday-reg-users.php sql injectionEPSS 0.4%CVE-2026-58213HIGHNATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injectionEPSS 0.4%CVE-2022-1074MEDIUMTEM FLEX-1085 injectionEPSS 0.4%CVE-2025-14952MEDIUMCampcodes Supplier Management System add_category.php sql injectionEPSS 0.4%CVE-2025-13169MEDIUMcode-projects Simple Online Hotel Reservation System add_query_reserve.php sql injectionEPSS 0.4%CVE-2025-5431MEDIUMAssamLook CMS department-profile.php sql injectionEPSS 0.4%CVE-2025-14643MEDIUMcode-projects Simple Attendance Record System check.php sql injectionEPSS 0.4%CVE-2025-13277MEDIUMcode-projects Nero Social Networking Site friendsphoto.php sql injectionEPSS 0.4%CVE-2025-12929MEDIUMSourceCodester Survey Application System LoginRegistration.php update_user sql injectionEPSS 0.4%CVE-2025-14590MEDIUMcode-projects Prison Management System search1.php sql injectionEPSS 0.4%CVE-2025-8922MEDIUMcode-projects Job Diary admin-inbox.php sql injectionEPSS 0.4%CVE-2025-8923MEDIUMcode-projects Job Diary edit-details.php sql injectionEPSS 0.4%