Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-7670MEDIUMJinher OA UserSel.aspx sql injectionEPSS 0.4%CVE-2026-76783MEDIUMDeDeCMS advancedsearch.php sql injectionEPSS 0.4%CVE-2026-4229MEDIUMvanna-ai vanna bigquery_vector.py remove_training_data sql injectionEPSS 0.4%CVE-2026-5813MEDIUMPHPGurukul Online Course Registration check_availability.php sql injectionEPSS 0.4%CVE-2026-4842MEDIUMitsourcecode Online Enrollment System Parameter index.php sql injectionEPSS 0.4%CVE-2026-6166MEDIUMcode-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injectionEPSS 0.4%CVE-2026-5672MEDIUMcode-projects Simple IT Discussion Forum Parameter edit-category.php sql injectionEPSS 0.4%CVE-2026-5238MEDIUMitsourcecode Payroll Management System Parameter view_employee.php sql injectionEPSS 0.4%CVE-2026-4235MEDIUMitsourcecode Online Enrollment System login.php sql injectionEPSS 0.4%CVE-2026-19764MEDIUMRaisecom Communication Command and Dispatch Management Platform getpwd.php sql injectionEPSS 0.4%CVE-2026-7070MEDIUMcode-projects Inventory Management System Login sql injectionEPSS 0.4%CVE-2026-8771MEDIUMlinlinjava litemall Front-end WeChat API WxGoodsController.java list sql injectionEPSS 0.4%CVE-2026-5180MEDIUMSourceCodester Simple Doctors Appointment System ajax.php sql injectionEPSS 0.4%CVE-2026-8128MEDIUMSourceCodester SUP Online Shopping viewmsg.php sql injectionEPSS 0.4%CVE-2026-6031MEDIUMcode-projects Simple IT Discussion Forum add-category-function.php sql injectionEPSS 0.4%CVE-2026-9447MEDIUMSourceCodester Simple POS and Inventory System search.php sql injectionEPSS 0.4%CVE-2026-8734MEDIUMOinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injectionEPSS 0.4%CVE-2026-5634MEDIUMprojectworlds Car Rental Project Parameter book_car.php sql injectionEPSS 0.4%CVE-2026-9544MEDIUMShenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig sql injectionEPSS 0.4%CVE-2026-6193MEDIUMPHPGurukul Daily Expense Tracking System register.php sql injectionEPSS 0.4%