Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6267MEDIUMzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 barcodeDetail sql injectionEPSS 0.4%CVE-2025-13485MEDIUMitsourcecode Online File Management System ajax.php sql injectionEPSS 0.4%CVE-2026-0852MEDIUMcode-projects Online Music Site AdminUpdateUser.php sql injectionEPSS 0.4%CVE-2026-4571MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injectionEPSS 0.4%CVE-2025-7522MEDIUMPHPGurukul Vehicle Parking Management System bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2026-4572MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injectionEPSS 0.4%CVE-2026-4777MEDIUMSourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injectionEPSS 0.4%CVE-2026-4569MEDIUMSourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injectionEPSS 0.4%CVE-2025-7520MEDIUMPHPGurukul Vehicle Parking Management System manage-category.php sql injectionEPSS 0.4%CVE-2026-4778MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injectionEPSS 0.4%CVE-2026-4825MEDIUMSourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injectionEPSS 0.4%CVE-2025-7479MEDIUMPHPGurukul Vehicle Parking Management System view--detail.php sql injectionEPSS 0.4%CVE-2025-7167MEDIUMcode-projects Responsive Blog Site category.php sql injectionEPSS 0.4%CVE-2025-7163MEDIUMPHPGurukul Zoo Management System add-animals.php sql injectionEPSS 0.4%CVE-2025-7481MEDIUMPHPGurukul Vehicle Parking Management System profile.php sql injectionEPSS 0.4%CVE-2025-7158MEDIUMPHPGurukul Zoo Management System manage-normal-ticket.php sql injectionEPSS 0.4%CVE-2025-7212MEDIUMitsourcecode Insurance Management System insertAgent.php sql injectionEPSS 0.4%CVE-2025-7484MEDIUMPHPGurukul Vehicle Parking Management System view-outgoingvehicle-detail.php sql injectionEPSS 0.4%CVE-2025-7166MEDIUMcode-projects Responsive Blog Site single.php sql injectionEPSS 0.4%CVE-2025-7161MEDIUMPHPGurukul Zoo Management System add-normal-ticket.php sql injectionEPSS 0.4%