Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-13291MEDIUMCampcodes Supplier Management System confirm_order.php sql injectionEPSS 0.4%CVE-2025-13272MEDIUMCampcodes School Fees Payment Management System manage_course.php sql injectionEPSS 0.4%CVE-2025-15354MEDIUMitsourcecode Society Management System add_admin.php sql injectionEPSS 0.4%CVE-2025-14336MEDIUMitsourcecode Student Management System promote.php sql injectionEPSS 0.4%CVE-2025-15034MEDIUMitsourcecode Student Management System record.php sql injectionEPSS 0.4%CVE-2025-13300MEDIUMitsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionEPSS 0.4%CVE-2026-0567MEDIUMcode-projects Content Management System pages.php sql injectionEPSS 0.4%CVE-2025-13299MEDIUMitsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionEPSS 0.4%CVE-2025-13421MEDIUMitsourcecode Human Resource Management System NoticeStore.php sql injectionEPSS 0.4%CVE-2025-13583MEDIUMcode-projects Question Paper Generator POST Parameter signupscript.php sql injectionEPSS 0.4%CVE-2025-15263MEDIUMBiggiDroid Simple PHP CMS Admin Login login.php sql injectionEPSS 0.4%CVE-2025-13235MEDIUMitsourcecode Inventory Management System login.php sql injectionEPSS 0.4%CVE-2025-14250MEDIUMcode-projects Online Ordering System user_contact.php sql injectionEPSS 0.4%CVE-2025-14661MEDIUMitsourcecode Student Managemen System advisers.php sql injectionEPSS 0.4%CVE-2025-13555MEDIUMCampcodes School File Management System Login index.php sql injectionEPSS 0.4%CVE-2026-0565MEDIUMcode-projects Content Management System delete.php sql injectionEPSS 0.4%CVE-2025-14211MEDIUMprojectworlds Advanced Library Management System delete_book.php sql injectionEPSS 0.4%CVE-2025-14621MEDIUMcode-projects Student File Management System update_user.php sql injectionEPSS 0.4%CVE-2025-14218MEDIUMcode-projects Currency Exchange System editotheraccount.php sql injectionEPSS 0.4%CVE-2025-13170MEDIUMcode-projects Simple Online Hotel Reservation System edit_account.php sql injectionEPSS 0.4%