Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-5848MEDIUMjeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injectionEPSS 0.4%CVE-2026-15533MEDIUMDedeCMS Column Management search.php code injectionEPSS 0.4%CVE-2025-10479MEDIUMSourceCodester Online Student File Management System index.php sql injectionEPSS 0.4%CVE-2025-10436MEDIUMCampcodes Computer Sales and Inventory System sup_searchfrm.php sql injectionEPSS 0.4%CVE-2025-10562MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2025-6868MEDIUMSourceCodester Simple Company Website manage.php sql injectionEPSS 0.4%CVE-2025-10663MEDIUMPHPGurukul Online Course Registration my-profile.php sql injectionEPSS 0.4%CVE-2026-15703MEDIUMSourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injectionEPSS 0.4%CVE-2026-76996MEDIUMSourceCodester Simple Online Food Ordering System view_order.php sql injectionEPSS 0.4%CVE-2026-14747MEDIUMcode-projects Real State Services addprojectsale.php sql injectionEPSS 0.4%CVE-2026-93979MEDIUMcode-projects Internship Management System login.php sql injectionEPSS 0.4%CVE-2025-2740MEDIUMPHPGurukul Old Age Home Management System eligibility.php sql injectionEPSS 0.4%CVE-2026-14746MEDIUMcode-projects Real State Services addprojectrent.php sql injectionEPSS 0.4%CVE-2026-0605MEDIUMcode-projects Online Music Site login.php sql injectionEPSS 0.4%CVE-2026-14640MEDIUMCodeAstro Apartment Visitor Management System Login index.php sql injectionEPSS 0.4%CVE-2026-16484MEDIUMSourceCodester Class and Exam Timetabling System edit_subjecta.php sql injectionEPSS 0.4%CVE-2026-75986MEDIUMcode-projects Online Job Portal System Password Recovery ForPass.php sql injectionEPSS 0.4%CVE-2026-86213MEDIUMMstfakts College-Management-System Search university.php mysqli_query sql injectionEPSS 0.4%CVE-2026-78201MEDIUMitsourcecode Payroll System admin_class.php login sql injectionEPSS 0.4%CVE-2026-86210MEDIUMSourceCodester Class and Exam Timetabling System delete_user_account.php sql injectionEPSS 0.4%