Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-9528MEDIUMitsourcecode Electronic Judging System delete_judge.php sql injectionEPSS 0.4%CVE-2026-5237MEDIUMitsourcecode Payroll Management System Parameter manage_user.php sql injectionEPSS 0.4%CVE-2026-5150MEDIUMcode-projects Accounting System Parameter viewin_costumer.php sql injectionEPSS 0.4%CVE-2026-5824MEDIUMcode-projects Simple Laundry System userchecklogin.php sql injectionEPSS 0.4%CVE-2026-6595MEDIUMProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injectionEPSS 0.4%CVE-2026-5829MEDIUMcode-projects Simple IT Discussion Forum content.php sql injectionEPSS 0.4%CVE-2026-9525MEDIUMitsourcecode Electronic Judging System edit_judge.php sql injectionEPSS 0.4%CVE-2026-6031MEDIUMcode-projects Simple IT Discussion Forum add-category-function.php sql injectionEPSS 0.4%CVE-2026-5565MEDIUMcode-projects Simple Laundry System Parameter delmemberinfo.php sql injectionEPSS 0.4%CVE-2026-4844MEDIUMcode-projects Online Food Ordering System Admin Login admin.php sql injectionEPSS 0.4%CVE-2026-4612MEDIUMitsourcecode Free Hotel Reservation System Parameter index.php sql injectionEPSS 0.4%CVE-2026-4955MEDIUMShenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injectionEPSS 0.4%CVE-2026-7127MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-8128MEDIUMSourceCodester SUP Online Shopping viewmsg.php sql injectionEPSS 0.4%CVE-2026-7228MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injectionEPSS 0.4%CVE-2026-7074MEDIUMitsourcecode Construction Management System execute1.php sql injectionEPSS 0.4%CVE-2026-5672MEDIUMcode-projects Simple IT Discussion Forum Parameter edit-category.php sql injectionEPSS 0.4%CVE-2026-85138MEDIUMSeaCMS WeChat index.php addslashes sql injectionEPSS 0.4%CVE-2026-4288MEDIUMTiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injectionEPSS 0.4%CVE-2026-5665MEDIUMcode-projects Online FIR System Login checklogin.php sql injectionEPSS 0.4%