Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6842MEDIUMcode-projects Product Inventory System edit_user.php sql injectionEPSS 0.4%CVE-2025-7568MEDIUMqianfox FoxCMS Video.php batchCope sql injectionEPSS 0.4%CVE-2025-6841MEDIUMcode-projects Product Inventory System edit_product.php sql injectionEPSS 0.4%CVE-2025-6610MEDIUMitsourcecode Employee Management System editempprofile.php sql injectionEPSS 0.4%CVE-2026-81834MEDIUMRooCodeInc Roo-Code README File ExecaTerminalProcess code injectionEPSS 0.4%CVE-2025-8952MEDIUMCampcodes Online Flight Booking Management System Login ajax.php sql injectionEPSS 0.4%CVE-2026-55558MEDIUMaiosmtplib: STARTTLS response injectionEPSS 0.4%CVE-2025-9531MEDIUMPortabilis i-Educar Agenda agenda.php sql injectionEPSS 0.4%CVE-2025-9758MEDIUMdeepakmisal24 Chemical Inventory Management System inventory_form.php sql injectionEPSS 0.4%CVE-2025-2390MEDIUMcode-projects Blood Bank Management System add_donor.php sql injectionEPSS 0.4%CVE-2024-12950MEDIUMcode-projects/projectworlds Travel Management System subcat.php sql injectionEPSS 0.4%CVE-2026-1050MEDIUMrisesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injectionEPSS 0.4%CVE-2026-76365MEDIUMStructured Query Language (SQL) Injection through Custom Lists in Splunk SOAREPSS 0.4%CVE-2025-14900MEDIUMCodeAstro Real Estate Management System Administrator Endpoint userdelete.php sql injectionEPSS 0.4%CVE-2025-13788MEDIUMChanjet CRM upgradeattribute.php sql injectionEPSS 0.4%CVE-2025-13449MEDIUMcode-projects Online Shop Project login.php sql injectionEPSS 0.4%CVE-2025-14650MEDIUMitsourcecode Online Cake Ordering System product.php sql injectionEPSS 0.4%CVE-2025-2852MEDIUMSourceCodester Food Ordering Management System view_menu.php sql injectionEPSS 0.4%CVE-2025-12594MEDIUMcode-projects Simple Online Hotel Reservation System add_account.php sql injectionEPSS 0.4%CVE-2025-9644MEDIUMitsourcecode Apartment Management System bill_setup.php sql injectionEPSS 0.4%