Weaknesses of type CWE-74

4,787 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-78244MEDIUMitsourcecode Real Estate Management System search.php sql injectionEPSS 0.4%CVE-2026-87921MEDIUMRizwan17 inventory-management-system manage.php update_record sql injectionEPSS 0.4%CVE-2026-78198MEDIUMSourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injectionEPSS 0.4%CVE-2026-79845MEDIUMcode-projects Simple Inventory System edit.php sql injectionEPSS 0.4%CVE-2026-77020MEDIUMCodeAstro Apartment Visitor Management System password-recovery.php sql injectionEPSS 0.4%CVE-2026-86222MEDIUMSourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injectionEPSS 0.4%CVE-2026-93980MEDIUMcode-projects Internship Management System Admin Login Form login.php sql injectionEPSS 0.4%CVE-2026-78143MEDIUMcode-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injectionEPSS 0.4%CVE-2026-86168MEDIUMcode-projects Content Management System login.php sql injectionEPSS 0.4%CVE-2026-90841MEDIUMPHPGurukul Blood Donor Management System Report Endpoint Report.php sql injectionEPSS 0.4%CVE-2026-14688MEDIUMitsourcecode Online Hotel Management System login.php sql injectionEPSS 0.4%CVE-2026-86180MEDIUMcode-projects Task Management System In PHP Login index.php sql injectionEPSS 0.4%CVE-2026-15703MEDIUMSourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injectionEPSS 0.4%CVE-2026-85403MEDIUMcode-projects Doctor Appointment System contactus.php sql injectionEPSS 0.4%CVE-2026-7060MEDIUMliyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injectionEPSS 0.4%CVE-2026-82614MEDIUMitsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injectionEPSS 0.4%CVE-2026-14756MEDIUMcode-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injectionEPSS 0.4%CVE-2026-16252MEDIUMBeijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injectionEPSS 0.4%CVE-2026-76574MEDIUMcode-projects Hospital Information System User Login UsersController.php login sql injectionEPSS 0.4%CVE-2026-13521MEDIUMSourceCodester Class and Exam Timetabling System preview5.php sql injectionEPSS 0.4%