Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-7607MEDIUMcode-projects Simple Shopping Cart save_order.php sql injectionEPSS 0.4%CVE-2025-7606MEDIUMcode-projects AVL Rooms city.php sql injectionEPSS 0.4%CVE-2025-9700MEDIUMSourceCodester Online Book Store publisher_list.php sql injectionEPSS 0.4%CVE-2025-8373MEDIUMcode-projects Vehicle Management print.php sql injectionEPSS 0.4%CVE-2025-9751MEDIUMCampcodes Online Learning Management System login.php sql injectionEPSS 0.4%CVE-2025-8156MEDIUMPHPGurukul User Registration & Login and User Management lastsevendays-reg-users.php sql injectionEPSS 0.4%CVE-2025-14646MEDIUMcode-projects Student File Management System delete_student.php sql injectionEPSS 0.4%CVE-2025-9729MEDIUMPHPGurukul Online Course Registration student-registration.php sql injectionEPSS 0.4%CVE-2025-7609MEDIUMcode-projects Simple Shopping Cart register.php sql injectionEPSS 0.4%CVE-2025-14622MEDIUMcode-projects Student File Management System save_user.php sql injectionEPSS 0.4%CVE-2025-9706MEDIUMSourceCodester Water Billing System edit.php sql injectionEPSS 0.4%CVE-2025-6847MEDIUMcode-projects Simple Forum forum_edit.php sql injectionEPSS 0.4%CVE-2025-7455MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_reserve.php sql injectionEPSS 0.4%CVE-2025-8326MEDIUMcode-projects Exam Form Submission delete_s7.php sql injectionEPSS 0.4%CVE-2025-8332MEDIUMcode-projects Online Farm System register.php sql injectionEPSS 0.4%CVE-2025-7461MEDIUMcode-projects Modern Bag action.php sql injectionEPSS 0.4%CVE-2025-10415MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2025-7466MEDIUM1000projects ABC Courier Management add_dealerrequest.php sql injectionEPSS 0.4%CVE-2025-14645MEDIUMcode-projects Student File Management System delete_user.php sql injectionEPSS 0.4%CVE-2025-10405MEDIUMitsourcecode Baptism Information Management System listbaptism.php sql injectionEPSS 0.4%