Weaknesses of type CWE-74

4,794 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4844MEDIUMcode-projects Online Food Ordering System Admin Login admin.php sql injectionEPSS 0.4%CVE-2026-85138MEDIUMSeaCMS WeChat index.php addslashes sql injectionEPSS 0.4%CVE-2026-4288MEDIUMTiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injectionEPSS 0.4%CVE-2026-4289MEDIUMTiandy Easy7 Integrated Management Platform getRecByTemplateId sql injectionEPSS 0.4%CVE-2026-4229MEDIUMvanna-ai vanna bigquery_vector.py remove_training_data sql injectionEPSS 0.4%CVE-2026-7130MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-5828MEDIUMcode-projects Simple IT Discussion Forum addcomment.php sql injectionEPSS 0.4%CVE-2026-7063MEDIUMcode-projects Employee Management System Endpoint eprocess.php sql injectionEPSS 0.4%CVE-2026-5564MEDIUMcode-projects Simple Laundry System Parameter searchguest.php sql injectionEPSS 0.4%CVE-2026-7075MEDIUMitsourcecode Construction Management System locations.php sql injectionEPSS 0.4%CVE-2026-4508MEDIUMPbootCMS Member Login MemberController.php checkUsername sql injectionEPSS 0.4%CVE-2026-7087MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-5150MEDIUMcode-projects Accounting System Parameter viewin_costumer.php sql injectionEPSS 0.4%CVE-2026-15482MEDIUMAster Telecom Azcall HTTP sis.php sql injectionEPSS 0.4%CVE-2026-5645MEDIUMprojectworlds Car Rental System Parameter pay.php sql injectionEPSS 0.4%CVE-2026-9528MEDIUMitsourcecode Electronic Judging System delete_judge.php sql injectionEPSS 0.4%CVE-2026-7226MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php login2 sql injectionEPSS 0.4%CVE-2026-5837MEDIUMPHPGurukul News Portal Project news-details.php sql injectionEPSS 0.4%CVE-2026-4838MEDIUMSourceCodester Malawi Online Market display.php sql injectionEPSS 0.4%CVE-2026-19764MEDIUMRaisecom Communication Command and Dispatch Management Platform getpwd.php sql injectionEPSS 0.4%