Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-12253MEDIUMAMTT Hotel Broadband Operation System get_expiredtime.php sql injectionEPSS 0.4%CVE-2025-2384MEDIUMcode-projects Real Estate Property Management System Parameter InsertCustomer.php sql injectionEPSS 0.4%CVE-2025-7219MEDIUMCampcodes Payroll Management System ajax.php sql injectionEPSS 0.4%CVE-2025-7220MEDIUMCampcodes Payroll Management System ajax.php sql injectionEPSS 0.4%CVE-2025-7218MEDIUMCampcodes Payroll Management System ajax.php sql injectionEPSS 0.4%CVE-2024-34062MEDIUMtqdm CLI arguments injection attackEPSS 0.4%CVE-2025-8468MEDIUMcode-projects Wazifa System reset.php sql injectionEPSS 0.4%CVE-2025-8467MEDIUMcode-projects Wazifa System regcontrol.php sql injectionEPSS 0.4%CVE-2026-90849MEDIUMSourceCodester College Notes Gallery Management System login.php sql injectionEPSS 0.4%CVE-2025-11668MEDIUMcode-projects Automated Voting System update_user.php sql injectionEPSS 0.4%CVE-2024-13037MEDIUM1000 Projects Attendance Tracking Management System report.php attendance_report sql injectionEPSS 0.4%CVE-2025-13242MEDIUMcode-projects Student Information System register.php sql injectionEPSS 0.4%CVE-2026-7206MEDIUMdubydu sqlite-mcp entry.py extract_to_json sql injectionEPSS 0.4%CVE-2024-10989MEDIUMcode-projects E-Health Care System detail.php sql injectionEPSS 0.4%CVE-2026-93972MEDIUMSourceCodester Online Reviewer Management System btn_functions.php sql injectionEPSS 0.4%CVE-2024-10987MEDIUMcode-projects E-Health Care System user_appointment.php sql injectionEPSS 0.4%CVE-2025-12617MEDIUMitsourcecode Billing System login_crud.php sql injectionEPSS 0.4%CVE-2026-14641MEDIUMSourceCodester Class and Exam Timetabling System edit_course.php sql injectionEPSS 0.4%CVE-2026-0576MEDIUMcode-projects Online Product Reservation System Parameter prod.php sql injectionEPSS 0.4%CVE-2025-11557MEDIUMprojectworlds Gate Pass Management System add-pass.php sql injectionEPSS 0.4%