Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-10807MEDIUMPHPGurukul Hospital Management System search.php cross site scriptingEPSS 0.4%CVE-2026-14691MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injectionEPSS 0.4%CVE-2026-7595MEDIUMnextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injectionEPSS 0.4%CVE-2025-7593MEDIUMcode-projects Job Diary view-all.php sql injectionEPSS 0.4%CVE-2026-8773MEDIUMlinlinjava litemall Database Setting DbUtil.java load argument injectionEPSS 0.4%CVE-2026-103229MEDIUMAdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injectionEPSS 0.4%CVE-2026-4564MEDIUMyangzongzhuan RuoYi Quartz Job job code injectionEPSS 0.4%CVE-2025-10077MEDIUMSourceCodester Online Polling System registeracc.php sql injectionEPSS 0.4%CVE-2026-8211MEDIUMcodelibs Fess JSP File AdminDesignAction.java update code injectionEPSS 0.4%CVE-2025-9691MEDIUMCampcodes Online Shopping System login.php sql injectionEPSS 0.4%CVE-2025-8334MEDIUMCampcodes Online Recruitment Management System ajax.php sql injectionEPSS 0.4%CVE-2026-90709MEDIUMYot CMS Admin Console admin.php eval code injectionEPSS 0.4%CVE-2025-10079MEDIUMPHPGurukul Small CRM get-quote.php sql injectionEPSS 0.4%CVE-2026-103230MEDIUMAdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injectionEPSS 0.4%CVE-2026-103231MEDIUMAdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injectionEPSS 0.4%CVE-2026-7388MEDIUMEyouCMS Template File FilemanagerLogic.php editFile code injectionEPSS 0.4%CVE-2025-7595MEDIUMcode-projects Job Diary view-cad.php sql injectionEPSS 0.4%CVE-2025-10076MEDIUMSourceCodester Online Polling System manage-profile.php sql injectionEPSS 0.4%CVE-2026-82958HIGHIn Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command byEPSS 0.4%CVE-2025-8338MEDIUMprojectworlds Online Admission System adminac.php sql injectionEPSS 0.4%