Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-8923MEDIUMcode-projects Job Diary edit-details.php sql injectionEPSS 0.4%CVE-2025-11039MEDIUMCampcodes Computer Sales and Inventory System us_edit1.php sql injectionEPSS 0.4%CVE-2025-9932MEDIUMPHPGurukul Beauty Parlour Management System update-image.php sql injectionEPSS 0.4%CVE-2025-9928MEDIUMprojectworlds Travel Management System viewcategory.php sql injectionEPSS 0.4%CVE-2025-8921MEDIUMcode-projects Job Diary user-apply.php sql injectionEPSS 0.4%CVE-2025-9926MEDIUMprojectworlds Travel Management System viewsubcategory.php sql injectionEPSS 0.4%CVE-2025-9930MEDIUM1000projects Beauty Parlour Management System contact-us.php sql injectionEPSS 0.4%CVE-2025-5170MEDIUMllisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo sql injectionEPSS 0.4%CVE-2025-6116MEDIUMDas Parking Management System 停车场管理系统 API Search sql injectionEPSS 0.4%CVE-2025-1844MEDIUMESAFENET CDG backupLogDetail.jsp sql injectionEPSS 0.4%CVE-2025-6117MEDIUMDas Parking Management System 停车场管理系统 API Search sql injectionEPSS 0.4%CVE-2023-29213CRITICALorg.xwiki.platform:xwiki-platform-logging-ui Injection vulnerabilityEPSS 0.4%CVE-2025-6118MEDIUMDas Parking Management System 停车场管理系统 API search sql injectionEPSS 0.4%CVE-2022-31087HIGHIncorrect Default Permissions in ldap-account-managerEPSS 0.4%CVE-2025-12256MEDIUMcode-projects Online Event Judging System edit_contestant.php sql injectionEPSS 0.4%CVE-2025-8248MEDIUMcode-projects Online Ordering System signup.php sql injectionEPSS 0.4%CVE-2026-20199MEDIUMA vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to exeEPSS 0.4%CVE-2025-6351MEDIUMitsourcecode Employee Record Management System editprofile.php sql injectionEPSS 0.4%CVE-2025-13122MEDIUMSourceCodester Patients Waiting Area Queue Management System api_patient_checkin.php getPatientAppointment sql injectionEPSS 0.4%CVE-2025-7218MEDIUMCampcodes Payroll Management System ajax.php sql injectionEPSS 0.4%