Weaknesses of type CWE-74

4,791 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4289MEDIUMTiandy Easy7 Integrated Management Platform getRecByTemplateId sql injectionEPSS 0.4%CVE-2026-6629MEDIUMMetasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injectionEPSS 0.4%CVE-2026-7227MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php login sql injectionEPSS 0.4%CVE-2026-9551MEDIUMDas Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injectionEPSS 0.4%CVE-2026-9383MEDIUMitsourcecode Electronic Judging System login.php sql injectionEPSS 0.4%CVE-2026-8734MEDIUMOinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injectionEPSS 0.4%CVE-2026-4842MEDIUMitsourcecode Online Enrollment System Parameter index.php sql injectionEPSS 0.4%CVE-2026-5672MEDIUMcode-projects Simple IT Discussion Forum Parameter edit-category.php sql injectionEPSS 0.4%CVE-2026-4235MEDIUMitsourcecode Online Enrollment System login.php sql injectionEPSS 0.4%CVE-2026-5634MEDIUMprojectworlds Car Rental Project Parameter book_car.php sql injectionEPSS 0.4%CVE-2026-7087MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-6037MEDIUMcode-projects Vehicle Showroom Management System AddVehicleFunction.php sql injectionEPSS 0.4%CVE-2026-7073MEDIUMitsourcecode Construction Management System execute.php sql injectionEPSS 0.4%CVE-2026-6164MEDIUMcode-projects Lost and Found Thing Management addcat.php sql injectionEPSS 0.4%CVE-2026-19764MEDIUMRaisecom Communication Command and Dispatch Management Platform getpwd.php sql injectionEPSS 0.4%CVE-2026-4612MEDIUMitsourcecode Free Hotel Reservation System Parameter index.php sql injectionEPSS 0.4%CVE-2026-9525MEDIUMitsourcecode Electronic Judging System edit_judge.php sql injectionEPSS 0.4%CVE-2026-8098MEDIUMcode-projects Feedback System checklogin.php sql injectionEPSS 0.4%CVE-2026-8128MEDIUMSourceCodester SUP Online Shopping viewmsg.php sql injectionEPSS 0.4%CVE-2026-6031MEDIUMcode-projects Simple IT Discussion Forum add-category-function.php sql injectionEPSS 0.4%