Weaknesses of type CWE-74

4,787 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-14755MEDIUMcode-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injectionEPSS 0.4%CVE-2026-15134MEDIUMCodeAstro Simple Online Leave Management System index.php sql injectionEPSS 0.4%CVE-2026-76762MEDIUMcode-projects Assessment Management welcome.php sql injectionEPSS 0.4%CVE-2026-19021MEDIUMSourceCodester Computer Repair Shop Management System Master.php delete_product sql injectionEPSS 0.4%CVE-2026-86221MEDIUMSourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injectionEPSS 0.4%CVE-2026-19919MEDIUMcode-projects Online Shopping System Login login.php sql injectionEPSS 0.4%CVE-2026-86161MEDIUMSourceCodester Online Voting System ajax.php delete_category sql injectionEPSS 0.4%CVE-2026-15676MEDIUMcode-projects Online Job Portal DeleteUser.php sql injectionEPSS 0.4%CVE-2026-19231MEDIUMSourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injectionEPSS 0.4%CVE-2026-14695MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injectionEPSS 0.4%CVE-2026-15675MEDIUMcode-projects Online Job Portal EditUser.php sql injectionEPSS 0.4%CVE-2026-19899MEDIUMSourceCodester Class and Exam Timetabling System edit_teacher.php sql injectionEPSS 0.4%CVE-2026-78247MEDIUMSourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injectionEPSS 0.4%CVE-2026-16228MEDIUMSourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injectionEPSS 0.4%CVE-2026-76990MEDIUMcode-projects Simple Inventory System delete.php sql injectionEPSS 0.4%CVE-2026-86298MEDIUMSourceCodester Class and Exam Timetabling System delete_subject.php sql injectionEPSS 0.4%CVE-2026-7632MEDIUMcode-projects Online Hospital Management System viewappointment.php sql injectionEPSS 0.4%CVE-2026-86225MEDIUMSourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injectionEPSS 0.4%CVE-2026-15135MEDIUMcode-projects Online Food Order System edit_food_items.php sql injectionEPSS 0.4%CVE-2026-14653MEDIUMSourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injectionEPSS 0.4%