Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-9751MEDIUMCampcodes Online Learning Management System login.php sql injectionEPSS 0.4%CVE-2025-11342MEDIUMcode-projects Online Course Registration edit-course.php sql injectionEPSS 0.4%CVE-2025-12315MEDIUMcode-projects Food Ordering System menu.php sql injectionEPSS 0.4%CVE-2025-0788MEDIUMESAFENET CDG content_top.jsp sql injectionEPSS 0.4%CVE-2025-10662MEDIUMSeaCMS admin_members.php sql injectionEPSS 0.4%CVE-2025-10387MEDIUMcodesiddhant Jasmin Ransomware handshake.php sql injectionEPSS 0.4%CVE-2025-12226MEDIUMSourceCodester Best House Rental Management System admin_class.php save_house sql injectionEPSS 0.4%CVE-2024-13001MEDIUMPHPGurukul Small CRM index.php sql injectionEPSS 0.4%CVE-2025-0786MEDIUMESAFENET CDG appDetail.jsp sql injectionEPSS 0.4%CVE-2023-36830MEDIUMSQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.EPSS 0.4%CVE-2026-78166MEDIUMprovectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injectionEPSS 0.4%CVE-2024-10806MEDIUMPHPGurukul Hospital Management System betweendates-detailsreports.php cross site scriptingEPSS 0.4%CVE-2026-14691MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injectionEPSS 0.4%CVE-2025-11343MEDIUMcode-projects Student Crud Operation delete.php sql injectionEPSS 0.4%CVE-2024-10842MEDIUMromadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scriptingEPSS 0.4%CVE-2025-11629MEDIUMRainyGao DocSys getUserList.do getUserList sql injectionEPSS 0.4%CVE-2026-42838MEDIUMMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-7595MEDIUMnextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injectionEPSS 0.4%CVE-2026-19932MEDIUMDefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injectionEPSS 0.4%CVE-2024-10807MEDIUMPHPGurukul Hospital Management System search.php cross site scriptingEPSS 0.4%