Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4841MEDIUMcode-projects Online Food Ordering System Shopping Cart cart.php sql injectionEPSS 0.4%CVE-2026-5147MEDIUMYunaiV yudao-cloud get-by-website sql injectionEPSS 0.4%CVE-2026-8132MEDIUMCodeAstro Leave Management System login.php sql injectionEPSS 0.4%CVE-2026-7389MEDIUMEyouCMS common.php GetSortData sql injectionEPSS 0.4%CVE-2026-7224MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injectionEPSS 0.4%CVE-2026-4632MEDIUMitsourcecode Online Enrollment System Parameter index.php sql injectionEPSS 0.4%CVE-2026-4190MEDIUMJawherKl node-api-postgres user.js User.getAll sql injectionEPSS 0.4%CVE-2026-90495MEDIUMFengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injectionEPSS 0.4%CVE-2026-6004MEDIUMcode-projects Simple IT Discussion Forum delete-category.php sql injectionEPSS 0.4%CVE-2026-7077MEDIUMitsourcecode Courier Management System edit_parcel.php sql injectionEPSS 0.4%CVE-2026-8126MEDIUMSourceCodester Comment System post_comment.php sql injectionEPSS 0.4%CVE-2026-6038MEDIUMcode-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injectionEPSS 0.4%CVE-2026-6164MEDIUMcode-projects Lost and Found Thing Management addcat.php sql injectionEPSS 0.4%CVE-2026-7550MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injectionEPSS 0.4%CVE-2026-4839MEDIUMSourceCodester Food Ordering System Parameter purchase.php sql injectionEPSS 0.4%CVE-2026-6149MEDIUMcode-projects Vehicle Showroom Management System BookVehicleFunction.php sql injectionEPSS 0.4%CVE-2026-5824MEDIUMcode-projects Simple Laundry System userchecklogin.php sql injectionEPSS 0.4%CVE-2026-5237MEDIUMitsourcecode Payroll Management System Parameter manage_user.php sql injectionEPSS 0.4%CVE-2026-4844MEDIUMcode-projects Online Food Ordering System Admin Login admin.php sql injectionEPSS 0.4%CVE-2026-85138MEDIUMSeaCMS WeChat index.php addslashes sql injectionEPSS 0.4%