Weaknesses of type CWE-74

4,798 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-14217MEDIUMcode-projects Currency Exchange System edittrns.php sql injectionEPSS 0.4%CVE-2025-14337MEDIUMitsourcecode Student Management System new_grade.php sql injectionEPSS 0.4%CVE-2024-11124MEDIUMTimGeyssens UIOMatic uioMaticObject.r sql injectionEPSS 0.4%CVE-2025-14653MEDIUMitsourcecode Student Management System addrecord.php sql injectionEPSS 0.4%CVE-2025-14250MEDIUMcode-projects Online Ordering System user_contact.php sql injectionEPSS 0.4%CVE-2025-14210MEDIUMprojectworlds Advanced Library Management System delete_member.php sql injectionEPSS 0.4%CVE-2025-14638MEDIUMitsourcecode Online Pet Shop Management System update_cnp.php sql injectionEPSS 0.4%CVE-2025-14209MEDIUMCampcodes School File Management System update_query.php sql injectionEPSS 0.4%CVE-2025-13578MEDIUMcode-projects Library System Login index.php sql injectionEPSS 0.4%CVE-2025-14335MEDIUMitsourcecode Student Management System new_school_year.php sql injectionEPSS 0.4%CVE-2025-14245MEDIUMIdeaCMS Coupon.php whereRaw sql injectionEPSS 0.4%CVE-2025-14527MEDIUMprojectworlds Advanced Library Management System view_book.php sql injectionEPSS 0.4%CVE-2025-14940MEDIUMcode-projects Scholars Tracking System delete_user.php sql injectionEPSS 0.4%CVE-2025-14248MEDIUMcode-projects Simple Shopping Cart adminlogin.php sql injectionEPSS 0.4%CVE-2025-14578MEDIUMitsourcecode Student Management System update_account.php sql injectionEPSS 0.4%CVE-2025-14877MEDIUMCampcodes Supplier Management System add_retailer.php sql injectionEPSS 0.4%CVE-2026-0544MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.4%CVE-2025-15198MEDIUMcode-projects College Notes Uploading System login.php sql injectionEPSS 0.4%CVE-2025-13557MEDIUMCampcodes Online Polling System registeracc.php sql injectionEPSS 0.4%CVE-2025-14249MEDIUMcode-projects Online Ordering System user_school.php sql injectionEPSS 0.4%