Weaknesses of type CWE-74
4,791 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2026-2171MEDIUMcode-projects Online Student Management System Login accounts.php sql injectionEPSS 0.4%CVE-2025-13298MEDIUMitsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionEPSS 0.4%CVE-2025-7540MEDIUMcode-projects Online Appointment Booking System getclinic.php sql injectionEPSS 0.4%CVE-2025-7610MEDIUMcode-projects Electricity Billing System change_password.php sql injectionEPSS 0.4%CVE-2025-7454MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_theater.php sql injectionEPSS 0.4%CVE-2025-9701MEDIUMSourceCodester Simple Cafe Billing System receipt.php sql injectionEPSS 0.4%CVE-2025-13285MEDIUMitsourcecode Online Voting System login.php sql injectionEPSS 0.4%CVE-2025-7456MEDIUMCampcodes Online Movie Theater Seat Reservation System reserve.php sql injectionEPSS 0.4%CVE-2025-9679MEDIUMitsourcecode Student Information System course_edit1.php sql injectionEPSS 0.4%CVE-2025-14514MEDIUMCampcodes Supplier Management System add_distributor.php sql injectionEPSS 0.4%CVE-2025-11614MEDIUMSourceCodester Best Salon Management System edit-appointment.php sql injectionEPSS 0.4%CVE-2025-7436MEDIUMCampcodes Online Recruitment Management System ajax.php sql injectionEPSS 0.4%CVE-2025-9730MEDIUMitsourcecode Apartment Management System updateProfile.php sql injectionEPSS 0.4%CVE-2025-7608MEDIUMcode-projects Simple Shopping Cart userlogin.php sql injectionEPSS 0.4%CVE-2025-9702MEDIUMSourceCodester Simple Cafe Billing System sales_report.php sql injectionEPSS 0.4%CVE-2025-9750MEDIUMCampcodes Online Learning Management System login.php sql injectionEPSS 0.4%CVE-2025-10402MEDIUMPHPGurukul Beauty Parlour Management System readenq.php sql injectionEPSS 0.4%CVE-2025-7483MEDIUMPHPGurukul Vehicle Parking Management System forgot-password.php sql injectionEPSS 0.4%CVE-2025-14623MEDIUMcode-projects Student File Management System update_student.php sql injectionEPSS 0.4%CVE-2025-8372MEDIUMcode-projects Exam Form Submission update_s7.php sql injectionEPSS 0.4%