Weaknesses of type CWE-74

4,787 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-0700MEDIUMcode-projects Intern Membership Management System check_admin.php sql injectionEPSS 0.4%CVE-2026-14762MEDIUMcode-projects Hotel and Tourism Reservation Room Management rooms.php sql injectionEPSS 0.4%CVE-2026-86160MEDIUMSourceCodester Online Voting System ajax.php delete_voting sql injectionEPSS 0.4%CVE-2026-14642MEDIUMSourceCodester Class and Exam Timetabling System edit_class2.php sql injectionEPSS 0.4%CVE-2026-15137MEDIUMcode-projects Interview Management System View.php sql injectionEPSS 0.4%CVE-2026-0607MEDIUMcode-projects Online Music Site AdminViewSongs.php sql injectionEPSS 0.4%CVE-2026-14745MEDIUMcode-projects Real State Services single-list_rent.php sql injectionEPSS 0.4%CVE-2026-85399MEDIUMcode-projects Hospital Information System PrespController.php getSinglePresp sql injectionEPSS 0.4%CVE-2026-85402MEDIUMcode-projects Doctor Appointment System booking.php sql injectionEPSS 0.4%CVE-2026-85398MEDIUMcode-projects Hospital Information System viewReq.php viewReq sql injectionEPSS 0.4%CVE-2026-94015MEDIUMSourceCodester Drug Recommendation System edit_user.php sql injectionEPSS 0.4%CVE-2026-82615MEDIUMitsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injectionEPSS 0.4%CVE-2026-1590MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.4%CVE-2026-90879MEDIUMzyx0814 FilePress Publish search.php sql injectionEPSS 0.4%CVE-2026-13527MEDIUMSourceCodester Class and Exam Timetabling System preview4.php sql injectionEPSS 0.4%CVE-2026-90805MEDIUMsubhajitkhan online-clinic-management-system doctorlogin.php sql injectionEPSS 0.4%CVE-2026-90515MEDIUMSourceCodester School Registration and Fee System delete_stud.php sql injectionEPSS 0.4%CVE-2026-14743MEDIUMcode-projects Real State Services normalHomeSale.php sql injectionEPSS 0.4%CVE-2026-90846MEDIUMPHPGurukul Daily Expense Tracker System forgot-password.php sql injectionEPSS 0.4%CVE-2026-13555MEDIUMitsourcecode Online Hotel Management System controller.php add sql injectionEPSS 0.4%