Weaknesses of type CWE-74
4,800 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-10418MEDIUMSourceCodester Student Grading System view_students.php sql injectionEPSS 0.4%CVE-2025-12856MEDIUMcode-projects Responsive Hotel Site reservation.php sql injectionEPSS 0.4%CVE-2025-13075MEDIUMcode-projects Responsive Hotel Site usersettingdel.php sql injectionEPSS 0.4%CVE-2025-11530MEDIUMcode-projects Online Complaint Site state.php sql injectionEPSS 0.4%CVE-2025-11603MEDIUMcode-projects Simple Food Ordering System editproduct.php sql injectionEPSS 0.4%CVE-2025-10828MEDIUMSourceCodester Pet Grooming Management Software edit.php sql injectionEPSS 0.4%CVE-2025-11516MEDIUMcode-projects Online Complaint Site complaint-details.php sql injectionEPSS 0.4%CVE-2025-11589MEDIUMCodeAstro Gym Management System user-payment.php sql injectionEPSS 0.4%CVE-2025-10825MEDIUMCampcodes Online Beauty Parlor Management System view-appointment.php sql injectionEPSS 0.4%CVE-2025-11054MEDIUMitsourcecode Open Source Job Portal index.php sql injectionEPSS 0.4%CVE-2025-11114MEDIUMCodeAstro Online Leave Application leaveAplicationForm.php sql injectionEPSS 0.4%CVE-2025-10804MEDIUMCampcodes Online Beauty Parlor Management System add-customer.php sql injectionEPSS 0.4%CVE-2025-12857MEDIUMcode-projects Responsive Hotel Site roombook.php sql injectionEPSS 0.4%CVE-2025-10421MEDIUMSourceCodester Student Grading System update_account.php sql injectionEPSS 0.4%CVE-2025-10807MEDIUMCampcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injectionEPSS 0.4%CVE-2025-10806MEDIUMCampcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2025-10805MEDIUMCampcodes Online Beauty Parlor Management System add-services.php sql injectionEPSS 0.4%CVE-2025-13076MEDIUMcode-projects Responsive Hotel Site usersetting.php sql injectionEPSS 0.4%CVE-2025-11514MEDIUMcode-projects Online Complaint Site index.php sql injectionEPSS 0.4%CVE-2025-8230MEDIUMCampcodes Courier Management System manage_user.php sql injectionEPSS 0.4%