Weaknesses of type CWE-74

4,787 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-13552MEDIUMitsourcecode Online Hotel Management System controller.php edit sql injectionEPSS 0.4%CVE-2026-76050MEDIUMSourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injectionEPSS 0.4%CVE-2026-91004MEDIUMSourceCodester Online Faculty Clearance System delete_faculty1.php sql injectionEPSS 0.4%CVE-2026-13486MEDIUMSourceCodester Class and Exam Timetabling System preview6.php sql injectionEPSS 0.4%CVE-2026-86208MEDIUMSourceCodester Class and Exam Timetabling System delete_teacher.php sql injectionEPSS 0.4%CVE-2026-90514MEDIUMSourceCodester School Registration and Fee System save_stud.php sql injectionEPSS 0.4%CVE-2026-0585MEDIUMcode-projects Online Product Reservation System GET Parameter order_view.php sql injectionEPSS 0.4%CVE-2026-0592MEDIUMcode-projects Online Product Reservation System User Registration register_code.php sql injectionEPSS 0.4%CVE-2026-19344MEDIUMcode-projects Task Management System comment_count_user.php sql injectionEPSS 0.4%CVE-2026-14660MEDIUMcode-projects Online Job Portal login.php sql injectionEPSS 0.4%CVE-2026-75079MEDIUMSourceCodester Class and Exam Timetabling System edit_subject2.php sql injectionEPSS 0.4%CVE-2026-77019MEDIUMCodeAstro Apartment Visitor Management System forgotpw.php sql injectionEPSS 0.4%CVE-2026-85379MEDIUMlight0011 cms Query Builder ChapterController.class.php searchChapter sql injectionEPSS 0.4%CVE-2026-14750MEDIUMmjperpinosa stumasy accessing_dictionary_authorization.php accessing_dictionary_authorization sql injectionEPSS 0.4%CVE-2026-16765MEDIUMCodeAstro Online Classroom loginlinkadmin.php sql injectionEPSS 0.4%CVE-2026-14772MEDIUMSourceCodester Class and Exam Timetabling System edit_course1.php sql injectionEPSS 0.4%CVE-2026-16152MEDIUMSourceCodester Class and Exam Timetabling System edit_rooma.php sql injectionEPSS 0.4%CVE-2026-14705MEDIUMcode-projects Online Examination head.php sql injectionEPSS 0.4%CVE-2026-13498MEDIUMyashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injectionEPSS 0.4%CVE-2026-86268MEDIUMitsourcecode School Management System User_Login.php sql injectionEPSS 0.4%