Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-6164MEDIUMcode-projects Lost and Found Thing Management addcat.php sql injectionEPSS 0.4%CVE-2026-79804MEDIUMSililaWijesinghe Food Ordering System search.php sql injectionEPSS 0.4%CVE-2026-4540MEDIUMprojectworlds Online Notes Sharing System Parameters login.php sql injectionEPSS 0.4%CVE-2026-7550MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injectionEPSS 0.4%CVE-2026-5554MEDIUMcode-projects Concert Ticket Reservation System Parameter process_search.php sql injectionEPSS 0.4%CVE-2026-7694MEDIUMAcrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injectionEPSS 0.4%CVE-2026-84111MEDIUMChanjet CRM jxf_dump_table.php sql injectionEPSS 0.4%CVE-2026-4956MEDIUMShenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injectionEPSS 0.4%CVE-2026-15517MEDIUMJinher OA PlanGiveOut.aspx sql injectionEPSS 0.4%CVE-2026-9355MEDIUMSourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injectionEPSS 0.4%CVE-2026-6142MEDIUMtushar-2223 Hotel Management System roomdelete.php sql injectionEPSS 0.4%CVE-2026-6161MEDIUMcode-projects Simple ChatBox Endpoint insert.php sql injectionEPSS 0.4%CVE-2026-9383MEDIUMitsourcecode Electronic Judging System login.php sql injectionEPSS 0.4%CVE-2026-4839MEDIUMSourceCodester Food Ordering System Parameter purchase.php sql injectionEPSS 0.4%CVE-2026-8083MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injectionEPSS 0.4%CVE-2026-9469MEDIUMyashpokharna2555 StudentManagementSystem success.php sql injectionEPSS 0.4%CVE-2026-4229MEDIUMvanna-ai vanna bigquery_vector.py remove_training_data sql injectionEPSS 0.4%CVE-2026-6182MEDIUMcode-projects Simple Content Management System login.php sql injectionEPSS 0.4%CVE-2026-6149MEDIUMcode-projects Vehicle Showroom Management System BookVehicleFunction.php sql injectionEPSS 0.4%CVE-2026-5648MEDIUMcode-projects Simple Laundry System Parameter userfinishregister.php sql injectionEPSS 0.4%