Weaknesses of type CWE-74

4,787 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-14754MEDIUMcode-projects Hotel and Tourism Reservation add_room.php sql injectionEPSS 0.4%CVE-2026-90877MEDIUMSourceCodester Online Faculty Clearance System update_requirement_status.php sql injectionEPSS 0.4%CVE-2026-0583MEDIUMcode-projects Online Product Reservation System User Login login.php sql injectionEPSS 0.4%CVE-2026-14652MEDIUMSourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injectionEPSS 0.4%CVE-2026-86209MEDIUMSourceCodester Class and Exam Timetabling System delete_user.php sql injectionEPSS 0.4%CVE-2026-90701MEDIUMsubhajitkhan online-clinic-management-system listdoctor.php sql injectionEPSS 0.4%CVE-2026-75014MEDIUMSourceCodester Pet Grooming Management Software get_barcode_data.php sql injectionEPSS 0.4%CVE-2026-15537MEDIUMSourceCodester Online Book Store System login.php sql injectionEPSS 0.4%CVE-2026-92406MEDIUMSourceCodester Inventory and Monitoring System btn_functions.php add sql injectionEPSS 0.4%CVE-2026-86224MEDIUMSourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injectionEPSS 0.4%CVE-2026-13485MEDIUMSourceCodester Class and Exam Timetabling System preview.php sql injectionEPSS 0.4%CVE-2026-14769MEDIUMcode-projects Real State Services pay.php sql injectionEPSS 0.4%CVE-2026-90526MEDIUMSourceCodester School Registration and Fee System save_class.php sql injectionEPSS 0.4%CVE-2026-87925MEDIUMRizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injectionEPSS 0.4%CVE-2026-19343MEDIUMcode-projects Task Management System AdminLogin.php sql injectionEPSS 0.4%CVE-2026-78171MEDIUMitsourcecode Sales and Inventory System processlogin.php sql injectionEPSS 0.4%CVE-2026-93973MEDIUMSourceCodester Online Reviewer Management System btn_functions.php remove sql injectionEPSS 0.4%CVE-2026-13551MEDIUMitsourcecode Baptism Information Management System editBaptism.php sql injectionEPSS 0.4%CVE-2026-75089MEDIUMPHPGurukul Complaint Management System check_availability.php sql injectionEPSS 0.4%CVE-2026-85397MEDIUMcode-projects Hospital Information System addReq.php findBySearch sql injectionEPSS 0.4%