Weaknesses of type CWE-74

4,786 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-86159MEDIUMSourceCodester Online Voting System ajax.php save_user sql injectionEPSS 0.4%CVE-2026-13566MEDIUMSourceCodester Class and Exam Timetabling System preview3.php sql injectionEPSS 0.4%CVE-2026-14735MEDIUMcode-projects Smart Parking System parkings.php sql injectionEPSS 0.4%CVE-2026-78199MEDIUMSourceCodester Simple Online Food Ordering System view_prod.php sql injectionEPSS 0.4%CVE-2026-13550MEDIUMitsourcecode Baptism Information Management System delbaptism.php sql injectionEPSS 0.4%CVE-2026-92926MEDIUMcode-projects Matrimonial System partner_preference.php writepartnerprefs sql injectionEPSS 0.4%CVE-2026-90876MEDIUMSourceCodester Online Faculty Clearance System delete_requirement.php sql injectionEPSS 0.4%CVE-2026-14744MEDIUMcode-projects Real State Services normalHomeRent.php sql injectionEPSS 0.4%CVE-2026-86290MEDIUMSourceCodester Online Voting System ajax.php save_category sql injectionEPSS 0.4%CVE-2026-76764MEDIUMcode-projects Employee Management System Admin Login Endpoint aprocess.php sql injectionEPSS 0.4%CVE-2026-14733MEDIUMSourceCodester Class and Exam Timetabling System edit_coursea.php sql injectionEPSS 0.4%CVE-2026-13565MEDIUMSourceCodester Class and Exam Timetabling System edit_class1.php sql injectionEPSS 0.4%CVE-2026-78248MEDIUMSourceCodester Simple Online Food Ordering System ajax.php save_settings sql injectionEPSS 0.4%CVE-2026-90844MEDIUMPHPGurukul Daily Expense Tracker System Login index.php sql injectionEPSS 0.4%CVE-2026-90516MEDIUMSourceCodester School Registration and Fee System pay_report.php sql injectionEPSS 0.4%CVE-2026-76048MEDIUMSourceCodester Simple Online Food Ordering System ajax.php login sql injectionEPSS 0.4%CVE-2026-13559MEDIUMcode-projects Real State Services single-list_sale.php add sql injectionEPSS 0.4%CVE-2026-81203MEDIUMSourceCodester Simple Online Food Ordering System ajax.php login2 sql injectionEPSS 0.4%CVE-2026-14764MEDIUMcode-projects Hotel and Tourism Reservation Event Management add_event.php sql injectionEPSS 0.4%CVE-2026-82613MEDIUMitsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injectionEPSS 0.4%