Weaknesses of type CWE-74
4,791 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-1906MEDIUMPHPGurukul Restaurant Table Booking System profile.php sql injectionEPSS 0.4%CVE-2025-10413MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2025-9704MEDIUMSourceCodester Water Billing System viewbill.php sql injectionEPSS 0.4%CVE-2025-61773HIGHpyLoad CNL and captcha handlers allow code Injection via unsanitized parametersEPSS 0.4%CVE-2025-10082MEDIUMSourceCodester Online Polling System manage-admins.php sql injectionEPSS 0.4%CVE-2025-10414MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2025-7459MEDIUMcode-projects Mobile Shop EditMobile.php sql injectionEPSS 0.4%CVE-2025-7480MEDIUMPHPGurukul Vehicle Parking Management System signup.php sql injectionEPSS 0.4%CVE-2025-14566MEDIUMkidaze CourseSelectionSystem reg.php sql injectionEPSS 0.4%CVE-2025-7457MEDIUMCampcodes Online Movie Theater Seat Reservation System manage_movie.php sql injectionEPSS 0.4%CVE-2025-9759MEDIUMCampcodes/SourceCodester Courier Management System ajax.php signup sql injectionEPSS 0.4%CVE-2025-9726MEDIUMCampcodes Farm Management System review.php sql injectionEPSS 0.4%CVE-2025-7611MEDIUMcode-projects Wedding Reservation global.php sql injectionEPSS 0.4%CVE-2025-7539MEDIUMcode-projects Online Appointment Booking System getdoctordaybooking.php sql injectionEPSS 0.4%CVE-2025-8333MEDIUMcode-projects Online Farm System categoryvalue.php sql injectionEPSS 0.4%CVE-2025-9739MEDIUMCampcodes Online Water Billing System process.php sql injectionEPSS 0.4%CVE-2025-14537MEDIUMcode-projects Class and Exam Timetable Management preview7.php sql injectionEPSS 0.4%CVE-2025-14585MEDIUMitsourcecode COVID Tracking System page sql injectionEPSS 0.4%CVE-2025-10078MEDIUMSourceCodester Online Polling System candidates.php sql injectionEPSS 0.4%CVE-2025-9705MEDIUMSourceCodester Water Billing System paybill.php sql injectionEPSS 0.4%