Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-8993MEDIUMImproper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacksEPSS 0.4%CVE-2026-1159MEDIUMitsourcecode Online Frozen Foods Ordering System order_online.php sql injectionEPSS 0.4%CVE-2024-10768MEDIUMPHPGurukul Online Shopping Portal two_tables.php cross site scriptingEPSS 0.4%CVE-2026-1449MEDIUMHisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injectionEPSS 0.4%CVE-2025-13255MEDIUMprojectworlds Advanced Library Management System book_search.php sql injectionEPSS 0.4%CVE-2025-14639MEDIUMitsourcecode Student Management System uprec.php sql injectionEPSS 0.4%CVE-2025-14649MEDIUMitsourcecode Online Cake Ordering System supplier.php sql injectionEPSS 0.4%CVE-2025-13557MEDIUMCampcodes Online Polling System registeracc.php sql injectionEPSS 0.4%CVE-2025-14621MEDIUMcode-projects Student File Management System update_user.php sql injectionEPSS 0.4%CVE-2025-13272MEDIUMCampcodes School Fees Payment Management System manage_course.php sql injectionEPSS 0.4%CVE-2025-15186MEDIUMcode-projects Refugee Food Management System addusers.php sql injectionEPSS 0.4%CVE-2025-13235MEDIUMitsourcecode Inventory Management System login.php sql injectionEPSS 0.4%CVE-2025-14832MEDIUMitsourcecode Online Cake Ordering System updateproduct.php sql injectionEPSS 0.4%CVE-2025-15181MEDIUMcode-projects Refugee Food Management System pagenateRefugeesList.php sql injectionEPSS 0.4%CVE-2025-14653MEDIUMitsourcecode Student Management System addrecord.php sql injectionEPSS 0.4%CVE-2025-14250MEDIUMcode-projects Online Ordering System user_contact.php sql injectionEPSS 0.4%CVE-2025-15034MEDIUMitsourcecode Student Management System record.php sql injectionEPSS 0.4%CVE-2025-14661MEDIUMitsourcecode Student Managemen System advisers.php sql injectionEPSS 0.4%CVE-2025-14652MEDIUMitsourcecode Online Cake Ordering System admindetail.php sql injectionEPSS 0.4%CVE-2025-14588MEDIUMitsourcecode Student Management System update_program.php sql injectionEPSS 0.4%