Weaknesses of type CWE-74

4,788 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-8993MEDIUMitsourcecode Online Tour and Travel Management System expense_report.php sql injectionEPSS 0.4%CVE-2025-8989MEDIUMSourceCodester COVID 19 Testing Management System edit-phlebotomist.php sql injectionEPSS 0.4%CVE-2025-12339MEDIUMCampcodes Retro Basketball Shoes Online Store admin_football.php sql injectionEPSS 0.4%CVE-2025-11052MEDIUMkidaze CourseSelectionSystem COUNT3s5.php sql injectionEPSS 0.4%CVE-2025-10068MEDIUMitsourcecode Online Discussion Forum add_views.php sql injectionEPSS 0.4%CVE-2025-14710MEDIUMFantasticLBP Hotels Server OrderList.php sql injectionEPSS 0.4%CVE-2025-11434MEDIUMitsourcecode Student Transcript Processing System login.php sql injectionEPSS 0.4%CVE-2025-9838MEDIUMitsourcecode Student Information Management System index.php sql injectionEPSS 0.4%CVE-2025-9598MEDIUMitsourcecode Apartment Management System year_setup.php sql injectionEPSS 0.4%CVE-2025-10781MEDIUMCampcodes Online Learning Management System edit_class.php sql injectionEPSS 0.4%CVE-2025-9010MEDIUMitsourcecode Online Tour and Travel Management System booking_report.php sql injectionEPSS 0.4%CVE-2025-10830MEDIUMCampcodes Computer Sales and Inventory System inv_edit1.php sql injectionEPSS 0.4%CVE-2025-7149MEDIUMCampcodes Advanced Online Voting System candidates_delete.php sql injectionEPSS 0.4%CVE-2025-7188MEDIUMcode-projects Chat System addmember.php sql injectionEPSS 0.4%CVE-2025-7189MEDIUMcode-projects Chat System send_message.php sql injectionEPSS 0.4%CVE-2025-7137MEDIUMSourceCodester Best Salon Management System schedule-staff.php sql injectionEPSS 0.4%CVE-2025-7138MEDIUMSourceCodester Best Salon Management System admin-profile.php sql injectionEPSS 0.4%CVE-2025-6879MEDIUMSourceCodester Best Salon Management System add-tax.php sql injectionEPSS 0.4%CVE-2025-6880MEDIUMSourceCodester Best Salon Management System edit-tax.php sql injectionEPSS 0.4%CVE-2025-7121MEDIUMCampcodes Complaint Management System complaint-details.php sql injectionEPSS 0.4%