Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-10087MEDIUMSourceCodester Pet Grooming Management Software profit_report.php sql injectionEPSS 0.4%CVE-2023-6164LOWMainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS InjectionEPSS 0.4%CVE-2025-10993MEDIUMMuYuCMS Template Management admin.php code injectionEPSS 0.4%CVE-2026-20130CRITICALCisco Identity Services Engine Hardening Release - Improper Neutralization VulnerabilitiesEPSS 0.4%CVE-2024-13020MEDIUMcode-projects Chat System chatroom.php sql injectionEPSS 0.4%CVE-2025-0700MEDIUMJoeyBling bootplus list sql injectionEPSS 0.4%CVE-2026-2158MEDIUMcode-projects Student Web Portal check_user.php sql injectionEPSS 0.4%CVE-2025-0701MEDIUMJoeyBling bootplus list sql injectionEPSS 0.4%CVE-2024-10928MEDIUMMonoCMS Posts Page opensaved.php cross site scriptingEPSS 0.4%CVE-2025-47948HIGHCocotais Bot has builtin .echo command injectionEPSS 0.4%CVE-2026-2706MEDIUMcode-projects Patient Record Management System fecalysis_not.php sql injectionEPSS 0.4%CVE-2026-6125MEDIUMDromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionEPSS 0.4%CVE-2026-4511MEDIUMvanna-ai vanna legacy exec injectionEPSS 0.4%CVE-2026-5594MEDIUMpremAI-io premsql followup.py eval code injectionEPSS 0.4%CVE-2026-3955MEDIUMelecV2P jsfile Endpoint wbjs.js runJSFile code injectionEPSS 0.4%CVE-2026-6599MEDIUMlangflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injectionEPSS 0.4%CVE-2026-7508MEDIUMBootstrap CMS Page Creation show.blade.php code injectionEPSS 0.4%CVE-2026-100314MEDIUMmathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injectionEPSS 0.4%CVE-2026-7700MEDIUMlangflow-ai langflow LambdaFilterComponent lambda_filter.p eval code injectionEPSS 0.4%CVE-2026-5556MEDIUMbadlogic pi-mono loader.ts discoverAndLoadExtensions code injectionEPSS 0.4%