Weaknesses of type CWE-74

4,799 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-7904MEDIUMitsourcecode Insurance Management System insertNominee.php sql injectionEPSS 0.4%CVE-2022-46265MEDIUMA vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnEPSS 0.4%CVE-2025-0579MEDIUMShiprocket Module REST API Module restapi sql injectionEPSS 0.4%CVE-2025-1116MEDIUMDreamvention Live AJAX Search Free live_search.searchresults search sql injectionEPSS 0.4%CVE-2025-15077MEDIUMitsourcecode Student Management System form137.php sql injectionEPSS 0.4%CVE-2025-13280MEDIUMCodeAstro Simple Inventory System Login index.php sql injectionEPSS 0.4%CVE-2025-15078MEDIUMitsourcecode Student Management System list_report.php sql injectionEPSS 0.4%CVE-2025-14960MEDIUMcode-projects Simple Blood Donor Management System editeddonor.php sql injectionEPSS 0.4%CVE-2025-14961MEDIUMcode-projects Simple Blood Donor Management System editedcampaign.php sql injectionEPSS 0.4%CVE-2025-1537MEDIUMHarpia DiagSystem atualatendimento_jpeg.php sql injectionEPSS 0.4%CVE-2025-13782MEDIUMtaosir WTCMS SlideController SlideController.class.php delete sql injectionEPSS 0.4%CVE-2025-15049MEDIUMcode-projects Online Farm System addProduct.php sql injectionEPSS 0.4%CVE-2025-14959MEDIUMcode-projects Simple Stock System signup.php sql injectionEPSS 0.4%CVE-2025-15185MEDIUMcode-projects Refugee Food Management System refugeesreport.php sql injectionEPSS 0.4%CVE-2017-20196MEDIUMItechscripts School Management Software notice-edit.php sql injectionEPSS 0.4%CVE-2025-15011MEDIUMcode-projects Simple Stock System logout.php sql injectionEPSS 0.4%CVE-2025-7490MEDIUMPHPGurukul Vehicle Parking Management System reg-users.php sql injectionEPSS 0.4%CVE-2025-13248MEDIUMSourceCodester Patients Waiting Area Queue Management System api_patient_schedule.php sql injectionEPSS 0.4%CVE-2025-5779MEDIUMcode-projects Patient Record Management System birthing.php sql injectionEPSS 0.4%CVE-2025-5780MEDIUMcode-projects Patient Record Management System view_dental.php sql injectionEPSS 0.4%