Weaknesses of type CWE-74
4,800 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-11589MEDIUMCodeAstro Gym Management System user-payment.php sql injectionEPSS 0.4%CVE-2025-10806MEDIUMCampcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2025-10420MEDIUMSourceCodester Student Grading System form137.php sql injectionEPSS 0.4%CVE-2025-11514MEDIUMcode-projects Online Complaint Site index.php sql injectionEPSS 0.4%CVE-2025-10807MEDIUMCampcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injectionEPSS 0.4%CVE-2025-10431MEDIUMSourceCodester Pet Grooming Management Software ajax_represent.php sql injectionEPSS 0.4%CVE-2025-10805MEDIUMCampcodes Online Beauty Parlor Management System add-services.php sql injectionEPSS 0.4%CVE-2026-54728MEDIUMbunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWebEPSS 0.4%CVE-2025-13302MEDIUMcode-projects Courier Management System add-new-officer.php sql injectionEPSS 0.4%CVE-2025-12855MEDIUMcode-projects Responsive Hotel Site newsletterdel.php sql injectionEPSS 0.4%CVE-2025-10848MEDIUMCampcodes Society Membership Information System check_student.php sql injectionEPSS 0.4%CVE-2025-11530MEDIUMcode-projects Online Complaint Site state.php sql injectionEPSS 0.4%CVE-2025-10419MEDIUMSourceCodester Student Grading System del_promote.php sql injectionEPSS 0.4%CVE-2025-11054MEDIUMitsourcecode Open Source Job Portal index.php sql injectionEPSS 0.4%CVE-2025-10592MEDIUMitsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injectionEPSS 0.4%CVE-2025-13075MEDIUMcode-projects Responsive Hotel Site usersettingdel.php sql injectionEPSS 0.4%CVE-2025-10620MEDIUMitsourcecode Online Clinic Management System editp2.php sql injectionEPSS 0.4%CVE-2025-10421MEDIUMSourceCodester Student Grading System update_account.php sql injectionEPSS 0.4%CVE-2025-11552MEDIUMcode-projects Online Complaint Site category.php sql injectionEPSS 0.4%CVE-2025-10429MEDIUMSourceCodester Pet Grooming Management Software ajax_product.php sql injectionEPSS 0.4%