Weaknesses of type CWE-74

4,788 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-11077MEDIUMCampcodes Online Learning Management System add_content.php sql injectionEPSS 0.4%CVE-2025-8985MEDIUMSourceCodester COVID 19 Testing Management System profile.php sql injectionEPSS 0.4%CVE-2025-8970MEDIUMitsourcecode Online Tour and Travel Management System booking.php sql injectionEPSS 0.4%CVE-2025-11585MEDIUMcode-projects Project Monitoring System useredit.php sql injectionEPSS 0.4%CVE-2025-9503MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 0.4%CVE-2025-11555MEDIUMCampcodes Online Learning Management System calendar_of_events.php sql injectionEPSS 0.4%CVE-2025-8971MEDIUMitsourcecode Online Tour and Travel Management System travellers.php sql injectionEPSS 0.4%CVE-2025-10808MEDIUMCampcodes Farm Management System uploadProduct.php sql injectionEPSS 0.4%CVE-2025-10565MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2025-9423MEDIUMCampcodes Online Water Billing System editecex.php sql injectionEPSS 0.4%CVE-2025-8983MEDIUMitsourcecode Online Tour and Travel Management System expense.php sql injectionEPSS 0.4%CVE-2025-11604MEDIUMprojectworlds Online Ordering Food System all-orders.php sql injectionEPSS 0.4%CVE-2025-9830MEDIUMPHPGurukul Beauty Parlour Management System add-customer-services.php sql injectionEPSS 0.4%CVE-2025-10435MEDIUMCampcodes Computer Sales and Inventory System cust_edit1.php sql injectionEPSS 0.4%CVE-2025-15169MEDIUMBiggiDroid Simple PHP CMS editsite.php sql injectionEPSS 0.4%CVE-2025-11599MEDIUMCampcodes Online Apartment Visitor Management System forgot-password.php sql injectionEPSS 0.4%CVE-2025-9304MEDIUMSourceCodester Online Bank Management System show.php sql injectionEPSS 0.4%CVE-2025-9599MEDIUMitsourcecode Apartment Management System month_setup.php sql injectionEPSS 0.4%CVE-2025-9596MEDIUMitsourcecode Sports Management System login.php sql injectionEPSS 0.4%CVE-2025-11476MEDIUMSourceCodester Simple E-Commerce Bookstore index.php sql injectionEPSS 0.4%