Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-0698MEDIUMcode-projects Intern Membership Management System edit_students.php sql injectionEPSS 0.4%CVE-2026-1533MEDIUMcode-projects Online Music Site AdminAddCategory.php sql injectionEPSS 0.4%CVE-2025-11094MEDIUMcode-projects E-Commerce Website admin_product_details.php sql injectionEPSS 0.4%CVE-2025-6867MEDIUMSourceCodester Simple Company Website manage.php sql injectionEPSS 0.4%CVE-2025-15435MEDIUMYonyou KSOA work_update.jsp sql injectionEPSS 0.4%CVE-2026-0803MEDIUMPHPGurukul Online Course Registration System enroll.php sql injectionEPSS 0.4%CVE-2026-2190MEDIUMitsourcecode School Management System controller.php sql injectionEPSS 0.4%CVE-2026-2116MEDIUMitsourcecode Society Management System edit_expenses.php sql injectionEPSS 0.4%CVE-2026-2088MEDIUMPHPGurukul Beauty Parlour Management System accepted-appointment.php sql injectionEPSS 0.4%CVE-2026-2189MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.4%CVE-2026-2114MEDIUMitsourcecode Society Management System edit_admin.php sql injectionEPSS 0.4%CVE-2026-2198MEDIUMcode-projects Online Reviewer System loaddata.php sql injectionEPSS 0.4%CVE-2025-8219MEDIUMShanghai Lingdang Information Technology Lingdang CRM HTTP POST Request tabdetail_moduleSave_dxkp.php sql injectionEPSS 0.4%CVE-2025-5762MEDIUMcode-projects Patient Record Management System view_hematology.php sql injectionEPSS 0.4%CVE-2025-7568MEDIUMqianfox FoxCMS Video.php batchCope sql injectionEPSS 0.4%CVE-2025-6842MEDIUMcode-projects Product Inventory System edit_user.php sql injectionEPSS 0.4%CVE-2025-9024MEDIUMPHPGurukul Beauty Parlour Management System book-appointment.php sql injectionEPSS 0.4%CVE-2026-81834MEDIUMRooCodeInc Roo-Code README File ExecaTerminalProcess code injectionEPSS 0.4%CVE-2026-55558MEDIUMaiosmtplib: STARTTLS response injectionEPSS 0.4%CVE-2025-6610MEDIUMitsourcecode Employee Management System editempprofile.php sql injectionEPSS 0.4%