Weaknesses of type CWE-74

4,799 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-14258MEDIUMitsourcecode Student Management System newsubject.php sql injectionEPSS 0.4%CVE-2025-13233MEDIUMitsourcecode Inventory Management System index.php sql injectionEPSS 0.4%CVE-2025-14638MEDIUMitsourcecode Online Pet Shop Management System update_cnp.php sql injectionEPSS 0.4%CVE-2025-13561MEDIUMSourceCodester Company Website CMS index.php sql injectionEPSS 0.4%CVE-2025-13410MEDIUMCampcodes Retro Basketball Shoes Online Store receipt.php sql injectionEPSS 0.4%CVE-2025-14223MEDIUMcode-projects Simple Leave Manager request.php sql injectionEPSS 0.4%CVE-2025-15181MEDIUMcode-projects Refugee Food Management System pagenateRefugeesList.php sql injectionEPSS 0.4%CVE-2025-14652MEDIUMitsourcecode Online Cake Ordering System admindetail.php sql injectionEPSS 0.4%CVE-2025-15208MEDIUMcode-projects Refugee Food Management System editrefugee.php sql injectionEPSS 0.4%CVE-2025-14644MEDIUMitsourcecode Student Management System update_subject.php sql injectionEPSS 0.4%CVE-2025-13271MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.4%CVE-2025-14250MEDIUMcode-projects Online Ordering System user_contact.php sql injectionEPSS 0.4%CVE-2025-14951MEDIUMcode-projects Scholars Tracking System home.php sql injectionEPSS 0.4%CVE-2025-14515MEDIUMCampcodes Supplier Management System add_unit.php sql injectionEPSS 0.4%CVE-2025-9236MEDIUMPortabilis i-Educar Tipos de usuàrio educar_tipo_usuario_lst.php sql injectionEPSS 0.4%CVE-2025-9666MEDIUMcode-projects Simple Grading System Admin Panel delete_student.php sql injectionEPSS 0.4%CVE-2026-53572MEDIUMKEDA: PostgreSQL connection string parameter injection via incomplete whitespace escapingEPSS 0.4%CVE-2025-1202MEDIUMSourceCodester Best Church Management Software edit_slider.php sql injectionEPSS 0.4%CVE-2025-1199MEDIUMSourceCodester Best Church Management Software role_crud.php sql injectionEPSS 0.4%CVE-2022-46265MEDIUMA vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnEPSS 0.4%