Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-76993LOWGreyDGL PentestGPT Web-Page Crawling injectionEPSS 0.4%CVE-2025-5696MEDIUMBrilliance Golden Link Secondary System rentChangeCheckInfoPage.htm sql injectionEPSS 0.4%CVE-2025-5697MEDIUMBrilliance Golden Link Secondary System tcCustDeferPosiQuery.htm sql injectionEPSS 0.4%CVE-2025-2351MEDIUMDayCloud StudentManage Login Endpoint adminScoreUrl sql injectionEPSS 0.4%CVE-2025-2353MEDIUMVAM Virtual Airlines Manager HTTP GET Parameter index.php sql injectionEPSS 0.4%CVE-2025-15003MEDIUMSeaCMS admin_video.php sql injectionEPSS 0.4%CVE-2025-14897MEDIUMCodeAstro Real Estate Management System Administrator Endpoint useragentdelete.php sql injectionEPSS 0.4%CVE-2025-12294MEDIUMSourceCodester Point of Sales delete_category.php sql injectionEPSS 0.4%CVE-2025-12314MEDIUMcode-projects Food Ordering System deleteitem.php sql injectionEPSS 0.4%CVE-2025-14899MEDIUMCodeAstro Real Estate Management System Administrator Endpoint stateadd.php sql injectionEPSS 0.4%CVE-2025-14898MEDIUMCodeAstro Real Estate Management System Administrator Endpoint userbuilderdelete.php sql injectionEPSS 0.4%CVE-2025-14833MEDIUMcode-projects Online Appointment Booking System deletemanagerclinic.php sql injectionEPSS 0.4%CVE-2024-10840MEDIUMromadebrian WEB-Sekolah Backend akun_edit.php cross site scriptingEPSS 0.4%CVE-2026-2221MEDIUMcode-projects Online Reviewer System Login index.php sql injectionEPSS 0.4%CVE-2025-5434MEDIUMAem Solutions CMS page.php sql injectionEPSS 0.4%CVE-2026-2220MEDIUMcode-projects Online Reviewer System btn_functions.php sql injectionEPSS 0.4%CVE-2025-13546MEDIUMashraf-kabir travel-agency Search results.php sql injectionEPSS 0.4%CVE-2025-11605MEDIUMcode-projects Client Details System update-profile.php sql injectionEPSS 0.4%CVE-2025-2624MEDIUMwestboy CicadasCMS save sql injectionEPSS 0.4%CVE-2026-86252MEDIUMh3 before 1.15.9 SSE Event Injection via Carriage ReturnEPSS 0.4%