Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-9469MEDIUMyashpokharna2555 StudentManagementSystem success.php sql injectionEPSS 0.4%CVE-2026-9606MEDIUMitsourcecode Courier Management System manage_user.php sql injectionEPSS 0.4%CVE-2026-5648MEDIUMcode-projects Simple Laundry System Parameter userfinishregister.php sql injectionEPSS 0.4%CVE-2026-4910MEDIUMShenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do sql injectionEPSS 0.4%CVE-2026-5198MEDIUMcode-projects Student Membership System Admin Login index.php sql injectionEPSS 0.4%CVE-2026-82914MEDIUMkishan0725 Hospital-Management-System search.php sql injectionEPSS 0.4%CVE-2026-8130MEDIUMSourceCodester SUP Online Shopping message.php sql injectionEPSS 0.4%CVE-2026-6187MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-9465MEDIUMTiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injectionEPSS 0.4%CVE-2026-7126MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-7077MEDIUMitsourcecode Courier Management System edit_parcel.php sql injectionEPSS 0.4%CVE-2026-5669MEDIUMCyber-III Student-Management-System Parameter login.php sql injectionEPSS 0.4%CVE-2026-4232MEDIUMTiandy Integrated Management Platform getAuthorityByUserId sql injectionEPSS 0.4%CVE-2026-18958MEDIUMimranrisal-dev Student-Management-System Login loginCheckTest.php sql injectionEPSS 0.4%CVE-2026-6151MEDIUMcode-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injectionEPSS 0.4%CVE-2026-7506MEDIUMSourceCodester Hotel Management System check sql injectionEPSS 0.4%CVE-2026-15489MEDIUMRafyMrX TOKO-ONLINE-ROTI login.php sql injectionEPSS 0.4%CVE-2026-4615MEDIUMSourceCodester Online Catering Reservation search.php sql injectionEPSS 0.4%CVE-2026-6038MEDIUMcode-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injectionEPSS 0.4%CVE-2026-4237MEDIUMitsourcecode Free Hotel Reservation System index.php sql injectionEPSS 0.4%