Weaknesses of type CWE-74

4,799 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-15410MEDIUMcode-projects Online Guitar Store login.php sql injectionEPSS 0.4%CVE-2025-5779MEDIUMcode-projects Patient Record Management System birthing.php sql injectionEPSS 0.4%CVE-2025-15011MEDIUMcode-projects Simple Stock System logout.php sql injectionEPSS 0.4%CVE-2025-13237MEDIUMitsourcecode Inventory Management System LogSignModal.PHP sql injectionEPSS 0.4%CVE-2025-5729MEDIUMcode-projects Health Center Patient Record Management System birthing_record.php sql injectionEPSS 0.4%CVE-2025-7490MEDIUMPHPGurukul Vehicle Parking Management System reg-users.php sql injectionEPSS 0.4%CVE-2025-5780MEDIUMcode-projects Patient Record Management System view_dental.php sql injectionEPSS 0.4%CVE-2025-15012MEDIUMcode-projects Refugee Food Management System home.php sql injectionEPSS 0.4%CVE-2025-13248MEDIUMSourceCodester Patients Waiting Area Queue Management System api_patient_schedule.php sql injectionEPSS 0.4%CVE-2025-7492MEDIUMPHPGurukul Vehicle Parking Management System manage-incomingvehicle.php sql injectionEPSS 0.4%CVE-2025-13247MEDIUMPHPGurukul Tourism Management System user-bookings.php sql injectionEPSS 0.4%CVE-2025-7489MEDIUMPHPGurukul Vehicle Parking Management System search-vehicle.php sql injectionEPSS 0.4%CVE-2025-14012MEDIUMJIZHICMS Batch Delete Comments deleteAll.html delete sql injectionEPSS 0.4%CVE-2025-14011MEDIUMJIZHICMS Add Display Name Field addcomment.html commentlist sql injectionEPSS 0.4%CVE-2025-13545MEDIUMashraf-kabir travel-agency index.php sql injectionEPSS 0.4%CVE-2025-15143MEDIUMEyouCMS Backend Template Management FilemanagerLogic.php sql injectionEPSS 0.4%CVE-2025-15442MEDIUMCRMEB product_list sql injectionEPSS 0.4%CVE-2025-15443MEDIUMCRMEB product_export sql injectionEPSS 0.4%CVE-2025-6766MEDIUMsfturing hosp_order OfficeServiceImpl.java getOfficeName sql injectionEPSS 0.4%CVE-2025-10430MEDIUMSourceCodester Pet Grooming Management Software barcode.php sql injectionEPSS 0.4%