Weaknesses of type CWE-74

4,788 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-10601MEDIUMSourceCodester Online Exam Form Submission index.php sql injectionEPSS 0.4%CVE-2025-9426MEDIUMitsourcecode Online Tour and Travel Management System package.php sql injectionEPSS 0.4%CVE-2025-12316MEDIUMcode-projects Courier Management System edit-courier.php sql injectionEPSS 0.4%CVE-2025-10113MEDIUMitsourcecode Student Information Management System index.php sql injectionEPSS 0.4%CVE-2025-8987MEDIUMSourceCodester COVID 19 Testing Management System test-details.php sql injectionEPSS 0.4%CVE-2025-8946MEDIUMprojectworlds Online Notes Sharing Platform login.php sql injectionEPSS 0.4%CVE-2025-10109MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 0.4%CVE-2025-9502MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 0.4%CVE-2025-9051MEDIUMprojectworlds Travel Management System updatecategory.php sql injectionEPSS 0.4%CVE-2025-10797MEDIUMcode-projects Hostel Management System index.php sql injectionEPSS 0.4%CVE-2025-8984MEDIUMitsourcecode Online Tour and Travel Management System expense_category.php sql injectionEPSS 0.4%CVE-2025-9764MEDIUMitsourcecode Sports Management System resultdetails.php sql injectionEPSS 0.4%CVE-2025-9600MEDIUMitsourcecode Apartment Management System member_type_setup.php sql injectionEPSS 0.4%CVE-2025-11601MEDIUMSourceCodester Online Student Result System login.php sql injectionEPSS 0.4%CVE-2025-9837MEDIUMitsourcecode Student Information Management System index.php sql injectionEPSS 0.4%CVE-2025-10416MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2025-8466MEDIUMcode-projects Online Farm System forgot_passfarmer.php sql injectionEPSS 0.4%CVE-2025-9304MEDIUMSourceCodester Online Bank Management System show.php sql injectionEPSS 0.4%CVE-2025-9052MEDIUMprojectworlds Travel Management System updatepackage.php sql injectionEPSS 0.4%CVE-2025-9761MEDIUMCampcodes Online Feeds Product Inventory System Login index.php sql injectionEPSS 0.4%