Weaknesses of type CWE-74

4,787 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-82613MEDIUMitsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injectionEPSS 0.4%CVE-2026-19710MEDIUMSourceCodester Simple Student Information System view_department.php sql injectionEPSS 0.4%CVE-2026-14649MEDIUMcode-projects Online Voting System saveVote.php test_input sql injectionEPSS 0.4%CVE-2026-93974MEDIUMSourceCodester Online Reviewer Management System btn_functions.php remove sql injectionEPSS 0.4%CVE-2026-14768MEDIUMcode-projects Real State Services builderHome.php sql injectionEPSS 0.4%CVE-2026-86220MEDIUMSourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injectionEPSS 0.4%CVE-2026-14713MEDIUMSourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injectionEPSS 0.4%CVE-2026-85187MEDIUMitsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injectionEPSS 0.4%CVE-2026-93997MEDIUMSourceCodester Drug Recommendation System edit_symptom.php sql injectionEPSS 0.4%CVE-2026-82612MEDIUMitsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injectionEPSS 0.4%CVE-2026-78246MEDIUMitsourcecode Online Clinic Management System Admin Login login.php sql injectionEPSS 0.4%CVE-2026-13526MEDIUMSourceCodester Class and Exam Timetabling System edit_class.php sql injectionEPSS 0.4%CVE-2026-75778MEDIUMcode-projects Task Management System Login Form index.php select_with_multiple_condition sql injectionEPSS 0.4%CVE-2026-1589MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.4%CVE-2026-76998MEDIUMSourceCodester Simple Online Food Ordering System ajax.php delete_category sql injectionEPSS 0.4%CVE-2026-90789MEDIUMitsourcecode Leave Management System login.php sql injectionEPSS 0.4%CVE-2026-19196MEDIUMSourceCodester Photo Share Website ajax.php login sql injectionEPSS 0.4%CVE-2026-13487MEDIUMSourceCodester Class and Exam Timetabling System archive.php sql injectionEPSS 0.4%CVE-2026-91848MEDIUMWuzhiCMS index.php getDataOfJson sql injectionEPSS 0.4%CVE-2026-85516MEDIUMcode-projects Vehicle Management System busprofile.php sql injectionEPSS 0.4%