Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4288MEDIUMTiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injectionEPSS 0.4%CVE-2026-7126MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-5665MEDIUMcode-projects Online FIR System Login checklogin.php sql injectionEPSS 0.4%CVE-2026-4842MEDIUMitsourcecode Online Enrollment System Parameter index.php sql injectionEPSS 0.4%CVE-2026-15514MEDIUMMetasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injectionEPSS 0.4%CVE-2026-9523MEDIUMAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform getCalcmeterDetailDayListTree sql injectionEPSS 0.4%CVE-2026-15907MEDIUMH3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injectionEPSS 0.4%CVE-2026-5634MEDIUMprojectworlds Car Rental Project Parameter book_car.php sql injectionEPSS 0.4%CVE-2026-4508MEDIUMPbootCMS Member Login MemberController.php checkUsername sql injectionEPSS 0.4%CVE-2026-82914MEDIUMkishan0725 Hospital-Management-System search.php sql injectionEPSS 0.4%CVE-2026-5813MEDIUMPHPGurukul Online Course Registration check_availability.php sql injectionEPSS 0.4%CVE-2026-6183MEDIUMcode-projects Simple Content Management System index.php sql injectionEPSS 0.4%CVE-2026-6166MEDIUMcode-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injectionEPSS 0.4%CVE-2026-6187MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php sql injectionEPSS 0.4%CVE-2026-5827MEDIUMcode-projects Simple IT Discussion Forum question-function.php sql injectionEPSS 0.4%CVE-2026-7670MEDIUMJinher OA UserSel.aspx sql injectionEPSS 0.4%CVE-2026-6152MEDIUMcode-projects Vehicle Showroom Management System StaffAddingFunction.php sql injectionEPSS 0.4%CVE-2026-5182MEDIUMSourceCodester Teacher Record System Parameter sql injectionEPSS 0.4%CVE-2026-5322MEDIUMAlejandroArciniegas mcp-data-vis MCP server.js request sql injectionEPSS 0.4%CVE-2026-15482MEDIUMAster Telecom Azcall HTTP sis.php sql injectionEPSS 0.4%