Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6332MEDIUMPHPGurukul Directory Management System manage-directory.php sql injectionEPSS 0.4%CVE-2025-5566MEDIUMPHPGurukul Notice Board System search-notice.php sql injectionEPSS 0.4%CVE-2025-5554MEDIUMPHPGurukul Rail Pass Management System pass-bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2025-6333MEDIUMPHPGurukul Directory Management System admin-profile.php sql injectionEPSS 0.4%CVE-2025-5694MEDIUMPHPGurukul Human Metapneumovirus Testing Management System search-report-result.php sql injectionEPSS 0.4%CVE-2025-6829MEDIUMaaluoxiang oa_system External Address Book outAddress sql injectionEPSS 0.4%CVE-2025-5693MEDIUMPHPGurukul Human Metapneumovirus Testing Management System bwdates-report-result.php sql injectionEPSS 0.4%CVE-2025-6320MEDIUMPHPGurukul Pre-School Enrollment System add-class.php sql injectionEPSS 0.4%CVE-2025-6319MEDIUMPHPGurukul Pre-School Enrollment System add-teacher.php sql injectionEPSS 0.4%CVE-2025-6890MEDIUMcode-projects Movie Ticketing System ticketConfirmation.php sql injectionEPSS 0.4%CVE-2025-6909MEDIUMPHPGurukul Old Age Home Management System add-scdetails.php sql injectionEPSS 0.4%CVE-2025-5655MEDIUMPHPGurukul Complaint Management System edit-subcategory.php sql injectionEPSS 0.4%CVE-2025-5653MEDIUMPHPGurukul Complaint Management System between-date-userreport.php sql injectionEPSS 0.4%CVE-2025-6884MEDIUMcode-projects Staff Audit System search_index.php sql injectionEPSS 0.4%CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2025-6331MEDIUMPHPGurukul Directory Management System search-directory.php sql injectionEPSS 0.4%CVE-2025-5784MEDIUMPHPGurukul Employee Record Management System myexp.php sql injectionEPSS 0.4%CVE-2025-10617MEDIUMSourceCodester Online Polling System positions.php sql injectionEPSS 0.4%CVE-2025-4863MEDIUMAdvaya Softech GEMS ERP Portal studentLogin.action sql injectionEPSS 0.4%CVE-2025-4242MEDIUMPHPGurukul Online Birth Certificate System between-dates-report.php sql injectionEPSS 0.4%