Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6884MEDIUMcode-projects Staff Audit System search_index.php sql injectionEPSS 0.4%CVE-2025-5655MEDIUMPHPGurukul Complaint Management System edit-subcategory.php sql injectionEPSS 0.4%CVE-2025-6319MEDIUMPHPGurukul Pre-School Enrollment System add-teacher.php sql injectionEPSS 0.4%CVE-2025-5656MEDIUMPHPGurukul Complaint Management System edit-category.php sql injectionEPSS 0.4%CVE-2025-6915MEDIUMPHPGurukul Student Record System register.php sql injectionEPSS 0.4%CVE-2025-5654MEDIUMPHPGurukul Complaint Management System edit-state.php sql injectionEPSS 0.4%CVE-2025-5554MEDIUMPHPGurukul Rail Pass Management System pass-bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2025-6912MEDIUMPHPGurukul Student Record System manage-students.php sql injectionEPSS 0.4%CVE-2025-5694MEDIUMPHPGurukul Human Metapneumovirus Testing Management System search-report-result.php sql injectionEPSS 0.4%CVE-2025-6850MEDIUMcode-projects Simple Forum forum1.php sql injectionEPSS 0.4%CVE-2025-5546MEDIUMPHPGurukul Daily Expense Tracker System expense-reports-detailed.php sql injectionEPSS 0.4%CVE-2025-6331MEDIUMPHPGurukul Directory Management System search-directory.php sql injectionEPSS 0.4%CVE-2025-6909MEDIUMPHPGurukul Old Age Home Management System add-scdetails.php sql injectionEPSS 0.4%CVE-2025-5858MEDIUMPHPGurukul Nipah Virus Testing Management System patient-report.php sql injectionEPSS 0.4%CVE-2025-6890MEDIUMcode-projects Movie Ticketing System ticketConfirmation.php sql injectionEPSS 0.4%CVE-2025-6914MEDIUMPHPGurukul Student Record System edit-student.php sql injectionEPSS 0.4%CVE-2025-5658MEDIUMPHPGurukul Complaint Management System updatecomplaint.php sql injectionEPSS 0.4%CVE-2025-5556MEDIUMPHPGurukul Teacher Subject Allocation Management System edit-teacher-info.php sql injectionEPSS 0.4%CVE-2025-5657MEDIUMPHPGurukul Complaint Management System manage-users.php sql injectionEPSS 0.4%