Weaknesses of type CWE-74

4,801 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-2117MEDIUMBeijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System reportCenter.do electricDocList sql injectionEPSS 0.4%CVE-2025-11113MEDIUMCodeAstro Online Leave Application signup.php sql injectionEPSS 0.4%CVE-2025-12614MEDIUMSourceCodester Best House Rental Management System admin_class.php delete_payment sql injectionEPSS 0.4%CVE-2026-0729MEDIUMcode-projects Intern Membership Management System add_activity.php sql injectionEPSS 0.4%CVE-2025-2587MEDIUMJinher OA C6 IncentivePlanFulfillAppprove.aspx sql injectionEPSS 0.4%CVE-2025-15182MEDIUMcode-projects Refugee Food Management System served.php sql injectionEPSS 0.4%CVE-2025-15184MEDIUMcode-projects Refugee Food Management System refugeesreport2.php sql injectionEPSS 0.4%CVE-2025-7936MEDIUMfuyang_lipengjun platform ScheduleJobLogController.java queryPage sql injectionEPSS 0.4%CVE-2025-13811MEDIUMjsnjfz WebStack-Guns PageFactory.java sql injectionEPSS 0.4%CVE-2021-32622MEDIUMFile upload local preview can run embedded scripts after user interactionEPSS 0.4%CVE-2026-2469HIGHVersions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used EPSS 0.4%CVE-2025-10251MEDIUMFoxCMS Images.php batchCope sql injectionEPSS 0.4%CVE-2025-3163MEDIUMInternLM LMDeploy conf.py open code injectionEPSS 0.4%CVE-2025-8018MEDIUMcode-projects Food Ordering Review System reservation_page.php sql injectionEPSS 0.4%CVE-2025-13121MEDIUMcameasy Liketea API Endpoint StoreController.php list sql injectionEPSS 0.4%CVE-2024-40637MEDIUMImplicit override for built-in materializations from installed packages in dbt-coreEPSS 0.4%CVE-2026-49452MEDIUMWeasyPrint: CSS Injection via Presentational HintsEPSS 0.4%CVE-2025-13485MEDIUMitsourcecode Online File Management System ajax.php sql injectionEPSS 0.4%CVE-2025-7482MEDIUMPHPGurukul Vehicle Parking Management System print.php sql injectionEPSS 0.4%CVE-2026-0852MEDIUMcode-projects Online Music Site AdminUpdateUser.php sql injectionEPSS 0.4%